@timqi/pier 0.1.7 → 0.1.8

package/dist/agent/credentials.js

@@ -22,8 +22,11 @@ export class CredentialStore {
         this.secrets = secrets;
         this.agentDir = agentDir;
     }
-    /** encrypt() throws the `secrets locked: ...` error a session open must fail with. */
-    assertUnlocked() {
+    /** encrypt() throws the `secrets locked: ...` error a session open must fail
+     *  with — after the boot's unlock attempt has settled, so a message that
+     *  arrives while vt is still reading the KEK waits instead of failing. */
+    async assertUnlocked() {
+        await this.secrets.settled();
         if (this.secrets.state === "locked")
             this.secrets.encrypt("");
     }

package/dist/agent/pi.js

@@ -616,7 +616,7 @@ export class PiAgentFactory {
     async openSnapshot(cwd, sessionManager, opts) {
         // A locked store is a refusal with a reason here, not "provider not
         // configured" later. Before appendSessionInfo, so nothing is written.
-        this.credentials?.assertUnlocked();
+        await this.credentials?.assertUnlocked();
         if (opts.name)
             sessionManager.appendSessionInfo(opts.name);
         // This runtime serves one session, so shadowing streamSimple is the

package/dist/boards/pier.css

@@ -4,33 +4,39 @@
    named helpers cover the shapes a report actually asks for. */
 
 :root {
-  --bg: #fbfbfa;
-  --fg: #1f2328;
-  --muted: #6a737d;
-  --line: #e4e4e2;
+  /* Warm paper rather than cool grey: a board is read like a printed page,
+     and the neutrals stay warm in dark mode too. */
+  --bg: #faf9f5;
+  --fg: #1f1e1d;
+  --muted: #6d6a62;
+  --line: #e6e2d8;
   --card: #ffffff;
-  --accent: #4f46e5;
-  --code-bg: #f4f4f3;
+  /* Clay accent: 5:1 on --bg and --card so plain links pass AA. */
+  --accent: #b5522f;
+  --code-bg: #f2efe6;
   /* Semantic palette: colour encodes meaning (good / attention / problem),
-     never decoration. Boards are presentations, so these are first-class. */
+     never decoration. Boards are presentations, so these are first-class.
+     `bad` is the one hue near the clay accent; it stays the cooler, more
+     saturated red so status never reads as decoration. */
   --good: #0f7b4f;
   --warn: #a25b00;
   --bad: #b42318;
+  --serif: ui-serif, Georgia, Cambria, "Songti SC", "Noto Serif CJK SC", serif;
   color-scheme: light dark;
 }
 
 @media (prefers-color-scheme: dark) {
   :root {
-    --bg: #16181c;
-    --fg: #e6e7e9;
-    --muted: #9aa0a6;
-    --line: #2c2f36;
-    --card: #1c1f24;
-    --accent: #8b87f7;
-    --code-bg: #22262c;
+    --bg: #22211e;
+    --fg: #f0eee7;
+    --muted: #a5a096;
+    --line: #3a3833;
+    --card: #2b2a26;
+    --accent: #e08a68;
+    --code-bg: #302e2a;
     --good: #4ade80;
     --warn: #fbbf24;
-    --bad: #f87171;
+    --bad: #f08a80;
   }
 }
 
@@ -49,13 +55,13 @@ html {
    while running prose keeps a readable measure (--measure) instead of
    stretching into 150-character lines. */
 body {
-  --measure: 46rem;
+  --measure: 44rem;
   margin: 0 auto;
-  max-width: 46rem;
-  padding: 2rem 1.15rem 5rem;
+  max-width: 44rem;
+  padding: 3rem 1.25rem 6rem;
   background: var(--bg);
   color: var(--fg);
-  font: 16px/1.6 -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans",
+  font: 17px/1.7 -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans",
     "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", sans-serif;
 }
 
@@ -87,28 +93,40 @@ body > blockquote {
   max-width: var(--measure);
 }
 
+/* Serif headings against a sans body: the contrast is what makes a plain
+   document look typeset instead of like an app screen. */
+h1,
+h2,
+h3 {
+  font-family: var(--serif);
+  /* Static serif fallbacks only have 400/700; a mid weight would snap anyway. */
+  font-weight: 600;
+}
+
 h1,
 h2,
 h3,
 h4 {
   line-height: 1.25;
-  margin: 2.2rem 0 0.6rem;
-  font-weight: 640;
-  letter-spacing: -0.01em;
+  margin: 2.4rem 0 0.7rem;
+  letter-spacing: -0.012em;
 }
 
 h1 {
   margin-top: 0;
-  font-size: 1.75rem;
+  font-size: 2.1rem;
 }
 h2 {
-  font-size: 1.3rem;
+  font-size: 1.45rem;
 }
 h3 {
-  font-size: 1.08rem;
+  font-size: 1.14rem;
 }
 h4 {
-  font-size: 1rem;
+  font-size: 0.95rem;
+  font-weight: 640;
+  letter-spacing: 0.02em;
+  text-transform: uppercase;
   color: var(--muted);
 }
 
@@ -165,10 +183,10 @@ samp {
 
 pre {
   overflow-x: auto;
-  padding: 0.85rem 1rem;
-  border-radius: 8px;
+  padding: 0.9rem 1.1rem;
+  border-radius: 10px;
   background: var(--code-bg);
-  line-height: 1.5;
+  line-height: 1.55;
 }
 
 pre code {
@@ -227,9 +245,9 @@ video {
 
 details {
   margin: 0 0 1rem;
-  padding: 0.7rem 0.9rem;
+  padding: 0.8rem 1rem;
   border: 1px solid var(--line);
-  border-radius: 8px;
+  border-radius: 12px;
   background: var(--card);
 }
 
@@ -280,10 +298,10 @@ footer {
 }
 
 .card {
-  padding: 0.9rem 1.1rem;
+  padding: 1.05rem 1.25rem;
   margin: 0 0 1rem;
   border: 1px solid var(--line);
-  border-radius: 10px;
+  border-radius: 12px;
   background: var(--card);
 }
 
@@ -310,10 +328,10 @@ footer {
 
 /* Opening block: title, one-line answer, and the numbers that matter. */
 .hero {
-  margin: 0 0 1.75rem;
-  padding: 1.4rem 1.5rem;
-  border-radius: 14px;
-  background: color-mix(in oklab, var(--accent) 9%, var(--card));
+  margin: 0 0 2rem;
+  padding: 1.6rem 1.75rem;
+  border-radius: 16px;
+  background: color-mix(in oklab, var(--accent) 8%, var(--card));
 }
 .hero h1 {
   margin-bottom: 0.4rem;
@@ -340,8 +358,9 @@ footer {
 
 .kpi {
   display: block;
-  font-size: 1.65rem;
-  font-weight: 650;
+  font-family: var(--serif);
+  font-size: 1.8rem;
+  font-weight: 700;
   line-height: 1.15;
   letter-spacing: -0.02em;
   font-variant-numeric: tabular-nums;

package/dist/channels/handoff.js

@@ -56,7 +56,7 @@ export function createHandoff(deps) {
             const base = publicUrl();
             const note = {
                 title: sessionLabel(summary),
-                url: base ? `${base}/#/session/${encodeURIComponent(sessionId)}` : "",
+                url: base ? `${base}/app/#/session/${encodeURIComponent(sessionId)}` : "",
             };
             let conversationId;
             try {

package/dist/cli.js

@@ -23,6 +23,7 @@ Usage
   pier restart                finish running turns first, then restart the service
   pier reload                 re-read channel config and recycle idle sessions
   pier backup                 snapshot pier.db before a manual update
+  pier login                  print a one-time sign-in link for the workbench (2 minutes)
   pier vault run [ENV=NAME | NAME]... -- <command> [args...]
                               run a command with named secrets in its env
   pier slack <subcommand> ... Slack from a shell, token from the vault (pier slack --help)
@@ -133,6 +134,13 @@ else if (command === "web") {
     const { runWebCli } = await import("./websearch/cli.js");
     process.exitCode = await runWebCli(argv.slice(1), (params) => askPier("/web", { params }, WEB_TIMEOUT_MS));
 }
+else if (command === "login") {
+    if (subcommand)
+        fail(`unexpected argument "${subcommand}"`);
+    allowOnly([], "pier login");
+    const { status, body } = await askPier("/login", {});
+    say(status === 200 && body.url ? body.url : fail(body.error ?? `socket answered ${String(status)}`));
+}
 else if (command === "restart" || command === "reload") {
     if (subcommand)
         fail(`unexpected argument "${subcommand}"`);

package/dist/db.js

@@ -304,6 +304,19 @@ const MIGRATIONS = [
     `
   ALTER TABLE conversations ADD COLUMN launch TEXT;
   CREATE INDEX conversations_session ON conversations(session_id);
+  `,
+    // 27 — passkeys (web/passkeys.ts): while one row exists the password is off.
+    `
+  -- id is the credential id (base64url); public_key a JWK, never private material.
+  CREATE TABLE passkeys (
+    id TEXT PRIMARY KEY,
+    public_key TEXT NOT NULL,
+    sign_count INTEGER NOT NULL,
+    transports TEXT NOT NULL,
+    label TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    last_used_at INTEGER
+  );
   `,
 ];
 /** `BEGIN IMMEDIATE`: taking the write lock up front turns a race with another

package/dist/main.js

@@ -40,6 +40,7 @@ import { currentVersion, startAutoUpdate, UpdateCheck } from "./update.js";
 import { Vault } from "./vault.js";
 import { servePier } from "./socket.js";
 import { AuthStore, registerAuthRoutes, requireAuth } from "./web/auth.js";
+import { PasskeyStore, registerPasskeyRoutes } from "./web/passkeys.js";
 import { registerConfigShareRoute, registerConfigSyncRoutes } from "./web/config-sync.js";
 import { PushStore, registerPushRoutes } from "./web/push.js";
 import { SessionStateStore } from "./web/session-state.js";
@@ -264,9 +265,11 @@ app.onError((err, c) => {
 // Before every route: Hono runs middleware in registration order, so a surface
 // added later is covered without knowing this exists.
 const auth = new AuthStore(db);
+const passkeys = new PasskeyStore(db);
 registerConfigShareRoute(app, configSync);
 app.use("*", requireAuth(auth));
-registerAuthRoutes(app, auth);
+registerAuthRoutes(app, auth, () => passkeys.any());
+registerPasskeyRoutes(app, { store: passkeys, auth, publicUrl: () => settings.get().publicUrl });
 registerConfigSyncRoutes(app, {
     sync: configSync,
     status: () => ({ ...configurationSync.status(), publicUrl: settings.get().publicUrl }),
@@ -308,6 +311,7 @@ app.route("/", createServer({
         return validated ? { tools: validated } : { error: CUSTOM_TOOL_RULES };
     },
     secrets,
+    passkeys,
     updates,
     updater,
     onUnlocked: () => void startChannels(),
@@ -323,7 +327,7 @@ servePier({
     vault,
     // The deep link an agent's "no secret named X" error carries; loopback when
     // no public URL is set, since nothing in the process can discover one.
-    fileUrl: (name) => `${settings.get().publicUrl || `http://127.0.0.1:${String(port)}`}/#/settings/vault?name=${name}`,
+    fileUrl: (name) => `${settings.get().publicUrl || `http://127.0.0.1:${String(port)}`}/app/#/settings/vault?name=${name}`,
     task: (params, callerSessionId) => tasks.handle(params, callerSessionId),
     // Progress and cost go to the log: the CLI's answer is the text alone.
     web: async (params, callerSessionId) => {
@@ -335,6 +339,7 @@ servePier({
     },
     // Live in the router, or on disk: the same two places a callback target is looked for.
     knows: async (id) => router.stateOf(id) !== undefined || (await factory.find(id)) !== undefined,
+    login: () => `${settings.get().publicUrl || `http://127.0.0.1:${String(port)}`}/login/${auth.mintLink()}`,
 });
 // Every command a turn runs inherits this env: `NODE_ENV=production` makes an
 // agent's `npm install` skip devDependencies, and PORT/HOST would aim its dev

package/dist/secrets.js

@@ -22,6 +22,11 @@ export class Secrets {
     #file;
     /** Why decrypt is refused right now — "" once unlocked. */
     #lockedReason = "unlock() has not run";
+    /** The unlock in flight. Boot starts it without waiting (the web has to
+     *  serve so a broken key can be repaired), so vt mode leaves a window the
+     *  length of a `vt read` in which a session open would refuse a store that
+     *  is about to be fine. */
+    #attempt;
     constructor(path = pierPath("master.key"), vt = vtCli) {
         this.path = path;
         this.vt = vt;
@@ -38,7 +43,16 @@ export class Secrets {
     /** Created on first boot in file mode, so an unattended start needs no
      *  ceremony. Throws and remembers why: the process must keep serving (web is
      *  how the operator repairs), and every refused decrypt names the reason. */
-    async unlock() {
+    unlock() {
+        this.#attempt = this.#unlock();
+        return this.#attempt;
+    }
+    /** Settles with the boot's unlock attempt, succeed or fail; immediate once it
+     *  has. A caller still asks `state` afterwards — this waits, it never grants. */
+    async settled() {
+        await this.#attempt?.catch(() => undefined);
+    }
+    async #unlock() {
         try {
             let raw;
             try {

package/dist/settings.js

@@ -5,6 +5,26 @@ import { pierDb, transact } from "./db.js";
 import { logger } from "./log.js";
 import { normalizeCustomTools } from "./tools.js";
 const log = logger("settings");
+/** The presets, each with the hex of its 600 step — what the manifest and the
+ *  icon paint with, since neither can read a CSS variable. The ramps
+ *  themselves are style.css's; this table must name the same colours. */
+export const ACCENTS = {
+    indigo: "#0066df",
+    teal: "#037f75",
+    emerald: "#028355",
+    amber: "#b17000",
+    rose: "#c51b53",
+    violet: "#7a49d3",
+};
+export const DEFAULT_ACCENT = "indigo";
+/** `""` and the default's own name both mean "no override"; anything not in
+ *  the table is rejected, never stored as a name the stylesheet lacks. */
+export function normalizeAccent(raw) {
+    const name = raw.trim();
+    if (!name || name === DEFAULT_ACCENT)
+        return "";
+    return Object.hasOwn(ACCENTS, name) ? name : null;
+}
 /** `""` clears it, `null` rejects it: a mistyped host quietly turned into a URL
  *  produces board links that 404 for the person they were sent to. */
 export function normalizePublicUrl(raw) {
@@ -89,6 +109,9 @@ export class SettingsStore {
     }
     get() {
         const titleModel = this.#json("titleModel", normalizeModelRef, "a {provider, id}");
+        const accent = normalizeAccent(this.#value("accent") ?? "");
+        if (accent === null)
+            log.warn("settings.accent is not a preset — ignoring it");
         return {
             publicUrl: this.#value("publicUrl") ?? "",
             modelMenu: this.#json("modelMenu", normalizeModelMenu, "a valid menu") ?? [],
@@ -98,6 +121,7 @@ export class SettingsStore {
             tools: this.#json("tools", normalizeTools, "a list of names") ?? [],
             // `"drop"`: a row the bundled catalog has since taken is redundant, not malformed.
             customTools: this.#json("customTools", (raw) => normalizeCustomTools(raw, "drop"), "a list of {name, toml}") ?? [],
+            accent: accent ?? "",
         };
     }
     /** A malformed row is named, not silently served as the empty value (§5). */
@@ -123,6 +147,10 @@ export class SettingsStore {
         this.#set("publicUrl", publicUrl);
         return this.get();
     }
+    setAccent(accent) {
+        this.#set("accent", accent);
+        return this.get();
+    }
     setModelMenu(menu) {
         this.#set("modelMenu", JSON.stringify(menu));
         return this.get();

package/dist/socket.js

@@ -11,6 +11,9 @@ import { isVaultName, UnknownSecret, VaultLocked } from "./vault.js";
 const log = logger("socket");
 /** Generous for a task draft; a `--prompt -` past it is told so, not hung up on. */
 const MAX_BODY = 64 * 1024;
+/** Typed by the operator in a terminal, not by an agent in a turn: the one
+ *  route with no session behind it. */
+const ANONYMOUS = new Set(["/login"]);
 const ROUTES = {
     async "/resolve"({ vault, fileUrl }, { names }, sessionId, answer) {
         if (!Array.isArray(names) || !names.length || !names.every((n) => typeof n === "string" && isVaultName(n))) {
@@ -30,6 +33,11 @@ const ROUTES = {
     },
     "/task": operation("task"),
     "/web": operation("web"),
+    async "/login"({ login }, _body, _sessionId, answer) {
+        const url = login();
+        log.info("sign-in link minted for pier login");
+        answer(200, { url });
+    },
 };
 /** A CLI verb's params under the caller's session. 422, not 400: the request
  *  was well-formed; what the operation refused is the caller's to read. */
@@ -90,7 +98,11 @@ async function handle(hosts, req, res) {
     catch {
         return answer(400, { error: "body must be a JSON object" });
     }
-    const { sessionId, ...fields } = typeof body === "object" && body !== null ? body : {};
+    if (typeof body !== "object" || body === null || Array.isArray(body))
+        return answer(400, { error: "body must be a JSON object" });
+    const { sessionId, ...fields } = body;
+    if (ANONYMOUS.has(req.url ?? ""))
+        return route(hosts, fields, "", answer);
     if (typeof sessionId !== "string" || !sessionId)
         return answer(400, { error: "PIER_SESSION_ID is required" });
     if (!(await hosts.knows(sessionId)))