pi-central 0.3.0 → 0.4.1

package/dist/ui/assets/logo-icon-BCSgj5RT.svg

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   width="27.417528mm"
+   height="27.417528mm"
+   viewBox="0 0 27.417529 27.417529"
+   version="1.1"
+   id="svg1"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg">
+  <g
+     id="layer1"
+     transform="translate(-25.653968,-66.727691)">
+    <path
+       id="path52"
+       style="fill:#3fa383;stroke-width:3.02717;stroke-linejoin:round;paint-order:stroke fill markers"
+       d="M 53.071496,80.436455 A 13.708764,13.708764 0 0 1 39.362732,94.145219 13.708764,13.708764 0 0 1 25.653968,80.436455 13.708764,13.708764 0 0 1 39.362732,66.727691 13.708764,13.708764 0 0 1 53.071496,80.436455 Z" />
+    <path
+       style="font-weight:600;font-size:30.375px;line-height:2;font-family:Roboto;-inkscape-font-specification:'Roboto, Semi-Bold';letter-spacing:7.50712px;fill:#ffffff;stroke-width:4.48942;stroke-linejoin:round;paint-order:stroke fill markers"
+       d="m 48.046608,72.559311 v 2.951477 H 30.530556 v -2.951477 z m -10.975342,0 V 88.60704 H 33.140907 V 72.559311 Z m 4.523621,0 h 3.930359 l -0.01483,11.286804 q 0,0.726746 0.19281,1.112366 0.207642,0.370788 0.57843,0.519104 0.38562,0.133484 0.934388,0.133484 0.38562,0 0.711914,-0.04449 0.326294,-0.04449 0.548767,-0.08899 l 0.01483,2.936645 q -0.504272,0.148316 -1.112365,0.252137 -0.608094,0.118652 -1.379334,0.118652 -1.320007,0 -2.313721,-0.459778 -0.993713,-0.459778 -1.54248,-1.468323 -0.548767,-1.023376 -0.548767,-2.684509 z"
+       id="text52"
+       aria-label="π" />
+  </g>
+</svg>

package/dist/ui/index.html

@@ -5,11 +5,41 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
+      content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
     />
     <title>Pi Central</title>
-    <script type="module" crossorigin src="/assets/index-CDs5_ZFh.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-Deb-EFhq.css">
+    <!--
+      An SVG icon first, because it is one file that stays sharp at every size, with a PNG fallback for
+      anything that cannot use it. `sizes="any"` tells the browser the SVG is scalable rather than
+      claiming a pixel size it does not have.
+
+      Both live in `src/assets/` so Vite fingerprints and emits them with the rest of the build — which
+      also means the orchestrator serves them with the right content type (`static-ui.ts` has `.svg` and
+      `.png`), rather than the app shipping a favicon the server would call `application/octet-stream`.
+    -->
+    <link rel="icon" type="image/svg+xml" href="/assets/logo-icon-BCSgj5RT.svg" sizes="any" />
+    <link rel="icon" type="image/png" href="/assets/logo-icon-CYTM3sb_.png" />
+    <!--
+      Safari's **Add to Dock** does not read the manifest's icons — it reads this link. So it has to be
+      here, at 180×180, at a STABLE path (issue #124).
+
+      Three faults in the previous version, and the symptom was exactly what they predict:
+        - it pointed at the 104×104 PNG, and Safari wants 180;
+        - it pointed into `src/assets/`, so the path was FINGERPRINTED — an icon URL is cached hard by
+          macOS and iOS, and a name that changes every build defeats that cache in the worst direction;
+        - and it was the only icon on a stable path that Safari could find, so when it rejected this one
+          there was nothing to fall back to but a screenshot of the page.
+    -->
+    <link rel="apple-touch-icon" href="/apple-touch-icon.png" />
+    <meta name="theme-color" content="#3fa383" />
+    <!--
+      Installable to the dock as a standalone window (issue #119). Deliberately NOT an offline app: every
+      screen is fed by the socket, so an installed Pi Central with the orchestrator down shows
+      `disconnected`. The manifest says `display: standalone`, not "works offline".
+    -->
+    <link rel="manifest" href="/manifest.webmanifest" />
+    <script type="module" crossorigin src="/assets/index-DO0lG4JX.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CPKDQr93.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/ui/manifest.webmanifest

@@ -0,0 +1,30 @@
+{
+  "name": "Pi Central",
+  "short_name": "Pi Central",
+  "description": "A local dashboard for running, watching, and switching between multiple sandboxed Pi coding-agent sessions.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#0e1116",
+  "theme_color": "#3fa383",
+  "icons": [
+    {
+      "src": "/apple-touch-icon.png",
+      "sizes": "180x180",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icon-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icon-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    }
+  ]
+}

package/dist/ui/sw.js

@@ -0,0 +1,93 @@
+/**
+ * The service worker (issue #119).
+ *
+ * ## What this is for, precisely
+ *
+ * A standalone window and a dock icon. **Not offline** — every screen is fed by the socket, so an
+ * installed Pi Central with the orchestrator down shows `disconnected` and nothing else. A worker that
+ * "worked offline" would install, open, and be useless while implying otherwise, so it deliberately does
+ * not try.
+ *
+ * ## The one rule that matters: `index.html` is NEVER cached
+ *
+ * `index.html` names the current fingerprint set, which is exactly what `static-ui.ts` says in its
+ * `Cache-Control`:
+ *
+ *     // `index.html` names the current fingerprint set, so caching it is exactly the mistake that
+ *     // serves a stale app after a rebuild.
+ *
+ * A worker that cached it would make a stale build **permanent and invisible** — no reload button, no URL
+ * to compare, and a worker the browser updates on its own schedule. So this file applies the SERVER's
+ * rule: hashed assets are immutable and cached forever, and the document is fetched from the network every
+ * time (issue #120 guards this).
+ *
+ * ## Why there is no precache list
+ *
+ * The build emits 266 chunks and 8.8 MB, dominated by Shiki grammars (`elisp` 772 kB, `cpp` 492 kB) that a
+ * session may never open. Precaching them would make the first visit pay for grammars it does not use. So
+ * everything is runtime-cached on FIRST REQUEST: the entry chunk and CSS on load, a grammar the first time
+ * that language appears. Nothing is fetched eagerly.
+ *
+ * ## `skipWaiting` is deliberately NOT used
+ *
+ * "Activate immediately" and "never interrupt a running session" pull in opposite directions, and this app
+ * holds live sessions. A worker that took over mid-stream would reload the UI under the reader. The new
+ * worker waits, and takes over on the next launch — which is the right trade for a tool that is open for
+ * hours at a time.
+ */
+const CACHE = "pi-central-v1";
+
+// A request for the app document, or for a directory that resolves to one.
+function isDocument(request, url) {
+  return request.mode === "navigate" || url.pathname === "/" || url.pathname.endsWith("/index.html");
+}
+
+self.addEventListener("install", (event) => {
+  // Nothing to precache — see the note above. `skipWaiting` is absent on purpose.
+  event.waitUntil(Promise.resolve());
+});
+
+self.addEventListener("activate", (event) => {
+  // Drop caches from previous versions of this worker, so a schema change cannot leave stale bytes around
+  // forever. Scoped to this prefix so another app on the same origin is untouched.
+  event.waitUntil(
+    caches.keys().then((names) =>
+      Promise.all(names.filter((name) => name.startsWith("pi-central-") && name !== CACHE).map((name) => caches.delete(name))),
+    ),
+  );
+});
+
+self.addEventListener("fetch", (event) => {
+  const request = event.request;
+  if (request.method !== "GET") return;
+
+  const url = new URL(request.url);
+  // Same-origin only. The app has no business proxying anything else, and doing so would be a hole.
+  if (url.origin !== self.location.origin) return;
+
+  // The socket is not a fetch, but a dev-server proxy or an `http` fallback could arrive here. Leave it.
+  if (url.pathname.startsWith("/ws")) return;
+
+  if (isDocument(request, url)) {
+    // NETWORK, always. No `cache.put`, no fallback to a cached document — a cached `index.html` is how a
+    // rebuild stops being visible. If the orchestrator is down the request fails, which is the honest
+    // outcome for an app that cannot work without it.
+    return;
+  }
+
+  // Hashed assets: cache-first, because their name cannot change under new content.
+  event.respondWith(
+    caches.match(request).then((cached) => {
+      if (cached !== undefined) return cached;
+      return fetch(request).then((response) => {
+        // Only a real, complete same-origin response is worth keeping. `opaque` responses have no usable
+        // status, and a 404 or a 500 must not become permanent.
+        if (response.ok && response.type === "basic") {
+          const copy = response.clone();
+          caches.open(CACHE).then((cache) => cache.put(request, copy));
+        }
+        return response;
+      });
+    }),
+  );
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-central",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "type": "module",
   "description": "Local dashboard that orchestrates multiple sandboxed Pi coding-agent sessions across working directories.",
   "license": "MIT",