my-durable 0.0.8 → 0.0.10

package/apps/dpi-backend/src/main.ts

@@ -35,6 +35,9 @@ const store = await Store.open({
 const app = express();
 app.disable("x-powered-by");
 app.get("/healthz", (_req, res) => res.json({ ok: true }));
+// The base URL is what people type first; a JSON 404 reads like a broken
+// daemon. Land them on the one real page (unpaired: enroll; paired: status).
+app.get("/", (_req, res) => res.redirect("/pair"));
 const pairing = new DevicePairing(store, config.home, config.name, process.env.DPI_HUB_URL, {
   // Forced hub change (P-5): once the new pairing is persisted the OLD
   // connector is stopped — never two live tunnels for one device, and the old

package/apps/dpi-tui/src/app.ts

@@ -26,7 +26,7 @@ import {
 } from "../../dpi-sdk/src/api.ts";
 import type { DeviceRow, NetworkRegistry } from "../../dpi-sdk/src/node/registry.ts";
 import { COMMANDS, runCommand } from "./commands.ts";
-import { Prompt, SecretPrompt, pickModel } from "./pickers.ts";
+import { Prompt, SecretPrompt, pickModel, newSession } from "./pickers.ts";
 import { renderHeader, renderHerd, renderHerdPanel, renderNetwork, renderStatusbar, renderViewbar, herdRows, joinPanel, networkRows } from "./views.ts";
 import { fetchHubNetwork } from "./hub-feed.ts";
 import { HubMux } from "./hub-mux.ts";
@@ -587,7 +587,7 @@ export class App {
       } else if (input.kind === "kill") {
         if (value.trim().toLowerCase().startsWith("y")) void this.command("reset");
         else this.notify("reset cancelled");
-      } else if (input.kind === "new") void this.command("new");
+      } else if (input.kind === "new") void newSession(this, value);
       return true;
     }
     if (data === "\x7f" || matchesKey(data, "backspace")) (input.value = input.value.slice(0, -1)), (this.suggIndex = 0);
@@ -855,7 +855,7 @@ export class App {
     }).slice(0, h);
     if (!wide) return table;
     const selected = this.sessions.find((s) => s.id === (this.selectedId ?? this.sessionId));
-    const panel = renderHerdPanel(panelW, h, selected, this.contextLeft());
+    const panel = renderHerdPanel(panelW, h, selected, this.contextLeft(), this.device.name);
     return joinPanel(table, panel, tableW, w, h);
   }
 

package/apps/dpi-tui/src/commands.ts

@@ -61,6 +61,11 @@ export async function runCommand(app: App, text: string): Promise<boolean> {
       pickDevice(app);
       break;
     case "new":
+      // "new agent" needs an open session; the n KEY (new session) is the other door.
+      if (!app.sessionId) {
+        app.notify("no session open — press n to create one");
+        break;
+      }
       await app.run(async () => {
         const created = await app.client.session(app.sessionId!).createAgent(arg ? { name: arg } : {});
         await app.attach(app.sessionId!, created.id);

package/apps/dpi-tui/src/pickers.ts

@@ -25,35 +25,91 @@ class Title implements Component {
   invalidate() {}
 }
 
-/** A titled SelectList; typing filters it. */
+/**
+ * A titled list with local filtering. Two deliberate departures from pi-tui's
+ * SelectList defaults, both found by driving the real picker:
+ *  - it filters on `value.startsWith`, so typing "pro" found nothing in a
+ *    directory named "project/"; we filter on the LABEL (substring), which is
+ *    what the user reads;
+ *  - its empty message is "No matching commands" — the wrong vocabulary for a
+ *    directory or model list, so the theme names the filter instead.
+ * j/k move (as the app advertises) instead of being swallowed as filter text.
+ */
 export class Picker extends Box {
-  readonly list: SelectList;
+  list: SelectList;
   private filter = "";
   private title: Title;
+  private readonly hintText: string;
   constructor(
     private label: string,
-    items: SelectItem[],
-    onPick: (item: SelectItem) => void,
-    onCancel: () => void,
-    hint = "↑↓ move │ enter select │ type to filter │ esc close",
-    subtitle?: string,
+    private readonly allItems: SelectItem[],
+    private onPick: (item: SelectItem) => void,
+    private readonly onCancel: () => void,
+    hint = "↑↓/j/k move │ enter select │ type to filter │ esc close",
+    private readonly subtitle?: string,
   ) {
     super(1, 0, panelBg);
+    this.hintText = hint;
     this.title = new Title(c.bold(c.accent(label)));
-    this.list = new SelectList(items, Math.max(1, Math.min(14, items.length)), selectTheme);
-    this.list.onSelect = onPick;
-    this.list.onCancel = onCancel;
+    this.list = this.makeList(this.allItems);
+    this.rebuild();
+  }
+  private makeList(items: SelectItem[]): SelectList {
+    const theme = {
+      ...selectTheme,
+      // Name the filter: "no match for “pro”" beats a command-palette phrase.
+      noMatch: (s: string) => c.muted(this.filter ? `  no match for “${this.filter}”` : s),
+    };
+    const list = new SelectList(items, Math.max(1, Math.min(14, items.length)), theme);
+    list.onSelect = this.onPick;
+    list.onCancel = this.onCancel;
+    return list;
+  }
+  /** Rebuild typing the children in order — the filter changes the item set. */
+  private rebuild() {
+    this.clear();
     this.addChild(this.title);
-    if (subtitle) this.addChild(new Title(subtitle));
+    if (this.subtitle) this.addChild(new Title(this.subtitle));
     this.addChild(this.list);
-    this.addChild(new Title(c.muted(hint)));
+    this.addChild(new Title(c.muted(this.hintText)));
+    this.invalidate();
+  }
+  /** Every item this picker was built with (shortcut lookups need the whole set). */
+  items(): SelectItem[] {
+    return this.allItems;
+  }
+  /** Run the same path a click/enter takes. */
+  pick(item: SelectItem) {
+    this.onPick(item);
+  }
+  private applyFilter() {
+    const needle = this.filter.toLowerCase();
+    const items = needle
+      ? this.allItems.filter((i) => `${i.label} ${i.description ?? ""}`.toLowerCase().includes(needle))
+      : this.allItems;
+    this.list = this.makeList(items);
+    this.title.text =
+      c.bold(c.accent(this.label)) + (this.filter ? c.muted(`  /${this.filter}`) : "");
+    this.rebuild();
   }
   handleInput(data: string) {
-    if (matchesKey(data, "backspace")) this.filter = this.filter.slice(0, -1);
-    else if (data.length === 1 && data >= " " && data !== "\x7f") this.filter += data;
-    else return this.list.handleInput(data);
-    this.list.setFilter(this.filter);
-    this.title.text = c.bold(c.accent(this.label)) + (this.filter ? c.muted(`  /${this.filter}`) : "");
+    // Navigation first: j/k are movement everywhere else in the app, so a list
+    // must not swallow them as filter characters.
+    // SelectList only knows arrows/enter/esc, so vim keys are translated to the
+    // arrow sequences it already understands.
+    if (data === "j") return this.list.handleInput("\x1b[B");
+    if (data === "k") return this.list.handleInput("\x1b[A");
+    if (matchesKey(data, "up") || matchesKey(data, "down") || matchesKey(data, "enter") || matchesKey(data, "escape"))
+      return this.list.handleInput(data);
+    if (matchesKey(data, "backspace")) {
+      this.filter = this.filter.slice(0, -1);
+      return this.applyFilter();
+    }
+    if (data.length === 1 && data >= " " && data !== "\x7f") {
+      this.filter += data;
+      return this.applyFilter();
+    }
+    this.list.handleInput(data);
   }
 }
 
@@ -216,17 +272,25 @@ export async function pickSession(app: App) {
   );
 }
 
-export async function newSession(app: App) {
-  const name = await app.prompt("Session name", "");
+export async function newSession(app: App, presetName?: string) {
+  // The `n` input line already carries the typed name — never re-ask for it.
+  const name = presetName !== undefined ? presetName : await app.prompt("Session name", "");
   if (name === undefined) return app.sessionId ? undefined : pickSession(app);
   const cwd = await walkDirs(app, "");
   if (!cwd) return app.sessionId ? undefined : pickSession(app);
-  const model = await chooseModel(app, app.info.defaultModel);
+  // A device without a provider key (the Windows default) lists ZERO models —
+  // the picker would be empty and creation dead-ends. Fall back to the device's
+  // own default exactly like the web dialog's "(device default)" option.
+  const models = app.info.models;
+  const model = models.length
+    ? await chooseModel(app, app.info.defaultModel)
+    : { provider: (app.info as { provider?: string }).provider ?? "openrouter", id: app.info.defaultModel, name: "(device default)" };
   if (!model) return;
   await app.run(async () => {
     const s = await app.client.createSession({ name: name || "New session", cwd, model: { provider: model.provider, modelId: model.id } });
     await app.attach(s.id, s.agents.find((a) => a.kind === "root")?.id ?? 1);
     app.flash(`Session created in ${cwd}`);
+    if (!models.length) app.flash(`no model catalog on the device — using its default (${app.info.defaultModel})`);
   });
 }
 
@@ -241,7 +305,7 @@ function walkDirs(app: App, path: string): Promise<string | undefined> {
         ...listing.dirs.map((d) => ({ value: d.path, label: `${d.name}/` })),
       ];
       app.overlay(
-        new Picker(`Working directory on ${app.device.id}`, items, (item) => {
+        new Picker(`Working directory on ${app.device.name}`, items, (item) => {
           app.closeOverlay();
           if (item.value.startsWith("use:")) done(item.value.slice(4));
           else void step(item.value);

package/apps/dpi-tui/src/views.ts

@@ -142,6 +142,16 @@ export function renderHerd(
     if (showAge) line += `  ${fit(c.muted(ageOf(s.createdAt)), cols.age)}`;
     lines.push(atCursor && !selected ? c.inverse(fit(line, w)) : fit(line, w));
   }
+  if (!rows.length && !opts.filter) {
+    // herdr never shows a bare header over nothing: the empty state points at
+    // the next move instead of a wall of blank rows.
+    lines.push(
+      "",
+      `  ${c.muted("no sessions yet on this device")}`,
+      "",
+      `  ${c.accent("n")} ${c.muted("new session")}   ${c.accent(":")} ${c.muted("palette")}   ${c.accent("N")} ${c.muted("network view")}`,
+    );
+  }
   if (opts.filter) lines.push(c.warn(`filter: ${opts.filter}`));
   // herdr frames pad EVERY line to the exact width — the caller paints rows as-is.
   return lines.map((l) => fit(l, w));
@@ -273,8 +283,23 @@ export function renderHerdPanel(
   h: number,
   s: SessionSummary | undefined,
   ctxLeft?: number,
+  device?: string,
 ): string[] {
-  if (!s) return Array.from({ length: Math.max(0, h) }, () => rep(" ", w));
+  // No session selected: a blank panel next to the divider is what made the
+  // wide layout look broken — herdr's panel always carries a device header.
+  if (!s) {
+    const lines = [
+      c.muted(" OVERVIEW"),
+      ` ${c.bold(device ?? "device")}`,
+      ` ${c.muted("no session selected")}`,
+      "",
+      ` ${c.muted("n")}        ${c.text("new session")}`,
+      ` ${c.muted("↵")}        ${c.text("open the cursor row")}`,
+      ` ${c.muted("j/k")}      ${c.text("move")}`,
+      ` ${c.muted(":")}        ${c.text("palette")}`,
+    ];
+    return lines.slice(0, h).map((l) => fit(l, w));
+  }
   const agents = s.agents.map((a) =>
     a.kind === "fork" ? `⑂ ${a.name}` : a.kind === "subagent" ? `↳ ${a.name}` : `● ${a.name}`,
   );

package/apps/dpi-tui/src/welcome.ts

@@ -194,8 +194,8 @@ export function validateDeviceInput(urlAnswer: string, tokenAnswer: string): { u
 // ------------------------------------------------------------------ the welcome screen
 
 export function welcomeItems(deviceCount: number, port: number): SelectItem[] {
-  // Values lead with the bracket letter, so typing it jumps to the action (the
-  // Picker filters on the value); enter selects it.
+  // The bracket letter is a real shortcut (see WelcomePicker) — typing it runs
+  // the action instead of relying on filter order.
   const items: SelectItem[] = [
     { value: "pair", label: "[p] Pair this machine", description: "code or pair URL from the hub wizard" },
     { value: "add-url", label: "[a] Add a device by URL", description: "http://host:port + its DPI_TOKEN" },
@@ -219,6 +219,12 @@ export class WelcomePicker extends Picker {
   }
   handleInput(data: string) {
     if (data === "q" || matchesKey(data, "escape")) return this.cancel();
+    // Letters in the labels are shortcuts, not filter text: "[d] Detect" must
+    // DETECT regardless of which other label happens to contain a "d".
+    if (data.length === 1) {
+      const item = this.items().find((i) => i.label.startsWith(`[${data}]`));
+      if (item) return this.pick(item);
+    }
     return super.handleInput(data);
   }
 }

package/bin/dpi.mjs

@@ -100,6 +100,10 @@ if (command === "update" || command === "upgrade") {
     });
     if (!res.ok) throw new Error(`registry responded ${res.status}`);
     latest = (await res.json()).version;
+    // This string is later interpolated into a command line (shell on Windows):
+    // anything that is not a plain semver must stop the update, not run.
+    if (!/^\d+\.\d+\.\d+(-[0-9A-Za-z.]+)?$/.test(String(latest)))
+      throw new Error(`registry returned a malformed version: ${latest}`);
   } catch (error) {
     process.stderr.write(`dpi update: cannot reach the npm registry (${error.message})\n`);
     process.exit(1);
@@ -132,7 +136,15 @@ if (command === "update" || command === "upgrade") {
     process.exit(0);
   }
 
-  const child = spawn("npm", ["install", "-g", `my-durable@${latest}`], { stdio: "inherit" });
+  // Windows: npm is npm.cmd and cmd.exe only executes batch files through a
+  // shell — a bare spawn("npm") dies with ENOENT (CreateProcess does no
+  // PATHEXT resolution). Args are literals plus the strictly-validated
+  // version above, so shell: true has no injection surface here.
+  const onWindows = process.platform === "win32";
+  const child = spawn(onWindows ? "npm.cmd" : "npm", ["install", "-g", `my-durable@${latest}`], {
+    stdio: "inherit",
+    shell: onWindows,
+  });
   child.on("error", (error) => {
     process.stderr.write(`dpi update: cannot run npm (${error.message})\n`);
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-durable",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Durable Pi \u2014 the durable agent network: hub web UI, device backend daemon, TUI admin and the shared SDK, packaged as one runnable monorepo install",
   "license": "MIT",
   "repository": {

package/scripts/verify.mjs

@@ -136,6 +136,16 @@ const SUITES = {
     cmd: ["node", "tests/pairing-ui.mjs"],
     title: "real PTY pairing lifecycle and 40/80/200-column resize",
   },
+  "ui:tui-session": {
+    cwd: "apps/dpi-tui",
+    cmd: ["node", "tests/newsession-ui.mjs"],
+    title: "real PTY session creation on a keyless device + empty-state layout",
+  },
+  "ui:tui-welcome": {
+    cwd: "apps/dpi-tui",
+    cmd: ["node", "tests/welcome-ui.mjs"],
+    title: "real PTY welcome screen, detect-local and quit",
+  },
 };
 
 const PHASE_GATES = ["test:verification", "check:sdk", "check:backend", "contract:backend", "build:playground", "check:tui"];
@@ -143,7 +153,20 @@ const PHASE_SUITES = {
   P0: ["sdk"],
   P1: ["sdk", "playground"],
   P2: ["sdk", "backend", "playground", "tui"],
-  ALL: ["sdk", "backend", "timing:backend", "playground", "tui", "lint:playground", "lint:core", "ui:network", "ui:pairing", "ui:tui"],
+  ALL: [
+    "sdk",
+    "backend",
+    "timing:backend",
+    "playground",
+    "tui",
+    "lint:playground",
+    "lint:core",
+    "ui:network",
+    "ui:pairing",
+    "ui:tui",
+    "ui:tui-session",
+    "ui:tui-welcome",
+  ],
 };
 
 function run(name, suite) {