pi-feats 0.1.1

package/extensions/lib/remote-hosts.ts

@@ -0,0 +1,392 @@
+import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+
+export const REMOTE_COMMAND_NAMES = ["remote", "add", "remove", "delete", "list"] as const;
+
+type RemoteRuntime = "host" | "docker";
+type RemoteHost = {
+  host: string;
+  port: number;
+  user: string;
+  piAgentDirectory: string;
+  runtime: RemoteRuntime;
+  container?: string;
+};
+type LegacyRemoteHost = Omit<RemoteHost, "piAgentDirectory"> & { piDataDirectory: string };
+type RemoteStore = { version: 2; remotes: Record<string, RemoteHost> };
+type RemoteSecrets = { version: 1; passwords: Record<string, string> };
+type DockerContainer = { id: string; name: string; image: string };
+type CommandResult = { code: number; stdout: string; stderr: string };
+
+const validName = (name: string) => /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(name);
+const shellQuote = (value: string) => `'${value.replaceAll("'", "'\\''")}'`;
+const remoteDirectory = (root: string) => join(root, "remote-hosts");
+const storePath = (root: string) => join(remoteDirectory(root), "remotes.json");
+const secretsPath = (root: string) => join(remoteDirectory(root), "secrets.json");
+const knownHostsPath = (root: string) => join(remoteDirectory(root), "known_hosts");
+
+function fail(message: string): never {
+  process.stderr.write(`Remote error: ${message}\n`);
+  process.exit(1);
+}
+
+async function ensureDirectory(root: string) {
+  await mkdir(remoteDirectory(root), { recursive: true, mode: 0o700 });
+  await chmod(remoteDirectory(root), 0o700);
+}
+
+function legacyPiAgentDirectory(directory: string) {
+  if (directory.endsWith("/agent")) return directory;
+  return directory === "~" ? "~/agent" : `${directory}/agent`;
+}
+
+async function readStore(root: string): Promise<RemoteStore> {
+  const path = storePath(root);
+  if (!existsSync(path)) return { version: 2, remotes: {} };
+  try {
+    const parsed = JSON.parse(await readFile(path, "utf8")) as { version?: unknown; remotes?: unknown };
+    if (!parsed.remotes || typeof parsed.remotes !== "object") throw new Error("invalid format");
+    if (parsed.version === 2) return { version: 2, remotes: parsed.remotes as Record<string, RemoteHost> };
+    if (parsed.version === 1) {
+      const remotes = Object.fromEntries(Object.entries(parsed.remotes as Record<string, LegacyRemoteHost>).map(([name, remote]) => [name, {
+        ...remote,
+        piAgentDirectory: legacyPiAgentDirectory(remote.piDataDirectory),
+      }]));
+      const migrated = { version: 2 as const, remotes };
+      await writePrivateJson(path, migrated);
+      return migrated;
+    }
+    throw new Error("unsupported format version");
+  } catch (error) {
+    fail(`could not read ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+async function readSecrets(root: string): Promise<RemoteSecrets> {
+  const path = secretsPath(root);
+  if (!existsSync(path)) return { version: 1, passwords: {} };
+  try {
+    const parsed = JSON.parse(await readFile(path, "utf8")) as Partial<RemoteSecrets>;
+    if (parsed.version !== 1 || !parsed.passwords || typeof parsed.passwords !== "object") throw new Error("invalid format");
+    return { version: 1, passwords: parsed.passwords as Record<string, string> };
+  } catch (error) {
+    fail(`could not read ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+async function writePrivateJson(path: string, value: unknown) {
+  await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+  await chmod(path, 0o600);
+}
+
+async function ask(label: string, defaultValue?: string): Promise<string> {
+  const prompt = defaultValue === undefined ? `${label}: ` : `${label} [${defaultValue}]: `;
+  const readline = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await readline.question(prompt)).trim();
+    return answer || defaultValue || "";
+  } finally {
+    readline.close();
+  }
+}
+
+async function askSecret(label: string): Promise<string> {
+  if (!process.stdin.isTTY) return ask(label);
+  process.stdout.write(`${label}: `);
+  return new Promise<string>((resolve, reject) => {
+    let value = "";
+    const stdin = process.stdin;
+    const restore = () => {
+      stdin.off("data", onData);
+      stdin.setRawMode?.(false);
+      stdin.pause();
+    };
+    const done = (result?: string, error?: Error) => {
+      restore();
+      process.stdout.write("\n");
+      if (error) reject(error); else resolve(result ?? "");
+    };
+    const onData = (chunk: Buffer) => {
+      const key = chunk.toString("utf8");
+      if (key === "\u0003") return done(undefined, new Error("cancelled"));
+      if (key === "\r" || key === "\n") return done(value);
+      if (key === "\u007f" || key === "\b") {
+        if (value.length) {
+          value = value.slice(0, -1);
+          process.stdout.write("\b \b");
+        }
+        return;
+      }
+      if (key >= " ") {
+        value += key;
+        process.stdout.write("*");
+      }
+    };
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    stdin.on("data", onData);
+  });
+}
+
+function validateHost(value: string) {
+  if (!value || /\s/.test(value)) fail("host must not be empty or contain whitespace.");
+}
+
+function validateUser(value: string) {
+  if (!value || /\s/.test(value)) fail("user must not be empty or contain whitespace.");
+}
+
+function validatePiAgentDirectory(value: string) {
+  if (!value || (!value.startsWith("/") && value !== "~" && !value.startsWith("~/"))) {
+    fail("Pi agent directory must be an absolute path or start with '~/'.");
+  }
+}
+
+function piAgentDirectoryExpression(directory: string): string {
+  if (directory === "~") return '"$HOME"';
+  if (directory.startsWith("~/")) return `"$HOME"/${shellQuote(directory.slice(2))}`;
+  return shellQuote(directory);
+}
+
+async function createAskpass(password: string): Promise<{ env: NodeJS.ProcessEnv; cleanup: () => Promise<void> }> {
+  if (!password) return { env: {}, cleanup: async () => {} };
+  const directory = await mkdtemp(join(tmpdir(), "pi-remote-askpass-"));
+  const path = join(directory, "askpass");
+  await writeFile(path, "#!/bin/sh\nprintf '%s' \"$PI_REMOTE_SSH_PASSWORD\"\n", { mode: 0o700 });
+  return {
+    env: { SSH_ASKPASS: path, SSH_ASKPASS_REQUIRE: "force", DISPLAY: "pi-remote", PI_REMOTE_SSH_PASSWORD: password },
+    cleanup: async () => { await rm(directory, { recursive: true, force: true }); },
+  };
+}
+
+async function runSsh(root: string, remote: Pick<RemoteHost, "host" | "port" | "user">, password: string, command: string, options: { acceptNewHost?: boolean; interactive?: boolean } = {}): Promise<CommandResult> {
+  await ensureDirectory(root);
+  const askpass = await createAskpass(password);
+  const args = [
+    ...(options.interactive ? ["-tt"] : ["-T"]),
+    "-p", String(remote.port),
+    "-o", "ConnectTimeout=15",
+    "-o", "ServerAliveInterval=15",
+    "-o", "ServerAliveCountMax=2",
+    "-o", `UserKnownHostsFile=${knownHostsPath(root)}`,
+    "-o", `StrictHostKeyChecking=${options.acceptNewHost ? "accept-new" : "yes"}`,
+    "-o", "PreferredAuthentications=publickey,password,keyboard-interactive",
+    `${remote.user}@${remote.host}`,
+    command,
+  ];
+  try {
+    return await new Promise<CommandResult>((resolve, reject) => {
+      const child = spawn("ssh", args, { stdio: options.interactive ? "inherit" : ["ignore", "pipe", "pipe"], env: { ...process.env, ...askpass.env } });
+      if (options.interactive) {
+        child.once("error", reject);
+        child.once("exit", (code) => resolve({ code: code ?? 1, stdout: "", stderr: "" }));
+        return;
+      }
+      let stdout = "", stderr = "";
+      child.stdout?.on("data", (chunk) => { stdout += chunk.toString(); });
+      child.stderr?.on("data", (chunk) => { stderr += chunk.toString(); });
+      child.once("error", reject);
+      child.once("exit", (code) => resolve({ code: code ?? 1, stdout, stderr }));
+    });
+  } finally {
+    await askpass.cleanup();
+  }
+}
+
+function remotePiExecutable() {
+  return `PI_REMOTE_PI="$(command -v pi 2>/dev/null || for candidate in "$HOME/.local/bin/pi" "$HOME/.hermes/node/bin/pi"; do [ -x "$candidate" ] && { printf '%s\\n' "$candidate"; break; }; done)"; [ -n "$PI_REMOTE_PI" ] || { echo "Pi executable was not found on the remote host." >&2; exit 127; }; PATH="$(dirname "$PI_REMOTE_PI"):$PATH"; export PATH`;
+}
+
+function hostPiCommand(remote: RemoteHost, args: string[]) {
+  return `${remotePiExecutable()}; env PI_CODING_AGENT_DIR=${piAgentDirectoryExpression(remote.piAgentDirectory)} "$PI_REMOTE_PI"${args.length ? ` ${args.map(shellQuote).join(" ")}` : ""}`;
+}
+
+function runtimeCommand(remote: RemoteHost, args: string[]) {
+  const piCommand = hostPiCommand(remote, args);
+  if (remote.runtime === "host") return piCommand;
+  if (!remote.container) fail("docker remote is missing its container name.");
+  return `docker exec -it ${shellQuote(remote.container)} sh -lc ${shellQuote(piCommand)}`;
+}
+
+function profileRuntimeCommand(remote: RemoteHost, profile: string, args: string[]) {
+  // Let the remote pi-feats package launch the profile. Manually setting the
+  // profile environment bypasses its sandbox/session setup and assumes a
+  // legacy root/extensions checkout that package installations do not have.
+  return runtimeCommand(remote, ["profile", profile, ...args]);
+}
+
+function runtimeBashCommand(remote: RemoteHost, args: string[]) {
+  const bashArgs = args.map(shellQuote).join(" ");
+  const shell = `cd ${piAgentDirectoryExpression(remote.piAgentDirectory)} && exec bash${bashArgs ? ` ${bashArgs}` : ""}`;
+  if (remote.runtime === "host") return shell;
+  if (!remote.container) fail("docker remote is missing its container name.");
+  return `docker exec -it ${shellQuote(remote.container)} sh -lc ${shellQuote(shell)}`;
+}
+
+async function testSsh(root: string, remote: Pick<RemoteHost, "host" | "port" | "user">, password: string) {
+  const result = await runSsh(root, remote, password, "true", { acceptNewHost: true });
+  if (result.code !== 0) fail(`SSH authentication failed: ${result.stderr.trim() || "connection failed"}`);
+}
+
+async function dockerAvailable(root: string, remote: Pick<RemoteHost, "host" | "port" | "user">, password: string) {
+  const result = await runSsh(root, remote, password, "command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1", { acceptNewHost: true });
+  return result.code === 0;
+}
+
+async function dockerContainers(root: string, remote: Pick<RemoteHost, "host" | "port" | "user">, password: string): Promise<DockerContainer[]> {
+  const result = await runSsh(root, remote, password, "docker ps --filter status=running --format '{{.ID}}\\t{{.Names}}\\t{{.Image}}'", { acceptNewHost: true });
+  if (result.code !== 0) fail(`could not list Docker containers: ${result.stderr.trim() || "docker command failed"}`);
+  return result.stdout.trim().split("\n").filter(Boolean).map((line) => {
+    const [id = "", name = "", image = ""] = line.split("\t");
+    return { id, name, image };
+  }).filter((container) => container.name.toLowerCase().includes("pi"));
+}
+
+async function chooseRuntime(dockerIsAvailable: boolean): Promise<RemoteRuntime> {
+  if (!dockerIsAvailable) return "host";
+  process.stdout.write("\nRuntime:\n  1. Host\n  2. Docker\n");
+  while (true) {
+    const choice = (await ask("Runtime", "1")).toLowerCase();
+    if (choice === "1" || choice === "host") return "host";
+    if (choice === "2" || choice === "docker") return "docker";
+    process.stderr.write("Enter 1 for Host or 2 for Docker.\n");
+  }
+}
+
+async function chooseContainer(containers: DockerContainer[]): Promise<string> {
+  if (containers.length) {
+    process.stdout.write("\nDetected running Pi containers:\n");
+    containers.forEach((container, index) => process.stdout.write(`  ${index + 1}. ${container.name}  ${container.id.slice(0, 12)}  ${container.image}\n`));
+  }
+  const defaultValue = containers.length === 1 ? "1" : undefined;
+  while (true) {
+    const value = await ask("Container name or number", defaultValue);
+    const selected = /^\d+$/.test(value) ? containers[Number(value) - 1]?.name : value;
+    if (selected && !/\s/.test(selected)) return selected;
+    process.stderr.write("Enter a valid container name or one of the listed numbers.\n");
+  }
+}
+
+async function verifyPi(root: string, remote: RemoteHost, password: string) {
+  const command = remote.runtime === "host"
+    ? hostPiCommand(remote, ["--version"])
+    : `docker exec ${shellQuote(remote.container ?? "")} sh -lc ${shellQuote(hostPiCommand(remote, ["--version"]))}`;
+  const result = await runSsh(root, remote, password, command, { acceptNewHost: true });
+  if (result.code !== 0) fail(`Pi is not available in the selected ${remote.runtime} runtime: ${result.stderr.trim() || "pi --version failed"}`);
+  process.stdout.write(`Pi detected: ${result.stdout.trim()}\n`);
+}
+
+async function addRemote(root: string, name: string) {
+  if (!validName(name)) fail("invalid remote name; use letters, numbers, hyphens, or underscores (max. 64 characters).");
+  const store = await readStore(root);
+  if (store.remotes[name]) fail(`remote '${name}' already exists.`);
+
+  const host = await ask("Host"); validateHost(host);
+  const portText = await ask("Port", "22");
+  const port = Number(portText);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) fail("port must be an integer between 1 and 65535.");
+  const user = await ask("User"); validateUser(user);
+  const password = await askSecret("Password (leave empty to use SSH key)");
+  const connection = { host, port, user };
+
+  process.stdout.write("Validating SSH access...\n");
+  await testSsh(root, connection, password);
+  const hasDocker = await dockerAvailable(root, connection, password);
+  if (hasDocker) process.stdout.write("Docker is available on the remote host.\n");
+  else process.stdout.write("Docker is not available to the remote user; Host runtime will be used.\n");
+
+  const runtime = await chooseRuntime(hasDocker);
+  const container = runtime === "docker" ? await chooseContainer(await dockerContainers(root, connection, password)) : undefined;
+  const piAgentDirectory = await ask("Pi agent directory", "~/.pi/agent"); validatePiAgentDirectory(piAgentDirectory);
+  const remote: RemoteHost = { ...connection, runtime, ...(container ? { container } : {}), piAgentDirectory };
+
+  process.stdout.write(`Validating Pi in the ${runtime} runtime...\n`);
+  await verifyPi(root, remote, password);
+  await ensureDirectory(root);
+  store.remotes[name] = remote;
+  await writePrivateJson(storePath(root), store);
+  const secrets = await readSecrets(root);
+  if (password) secrets.passwords[name] = password;
+  else delete secrets.passwords[name];
+  await writePrivateJson(secretsPath(root), secrets);
+  process.stdout.write(`Remote '${name}' added.\n`);
+}
+
+async function listRemotes(root: string) {
+  const store = await readStore(root);
+  const entries = Object.entries(store.remotes).sort(([a], [b]) => a.localeCompare(b));
+  if (!entries.length) {
+    process.stdout.write("No remotes configured.\n");
+    return;
+  }
+  for (const [name, remote] of entries) {
+    process.stdout.write(`${name}\t${remote.runtime}\t${remote.user}@${remote.host}:${remote.port}\t${remote.container ?? "-"}\t${remote.piAgentDirectory}\n`);
+  }
+}
+
+async function deleteRemote(root: string, name: string, force: boolean) {
+  if (!force) fail("deletion requires --force: pi remote delete <name> --force");
+  const store = await readStore(root);
+  if (!store.remotes[name]) fail(`remote '${name}' does not exist.`);
+  delete store.remotes[name];
+  await writePrivateJson(storePath(root), store);
+  const secrets = await readSecrets(root);
+  delete secrets.passwords[name];
+  await writePrivateJson(secretsPath(root), secrets);
+  process.stdout.write(`Remote '${name}' deleted.\n`);
+}
+
+const profileManagementActions = new Set(["add", "create", "delete", "list", "open", "remove", "resume"]);
+const profileResourceCommands = new Set(["extensions", "packages", "sessions", "skills", "tools"]);
+
+function requestedProfile(args: string[]): string | undefined {
+  if (args[0] !== "profile" || !args[1] || profileManagementActions.has(args[1].toLowerCase())) return undefined;
+  return args[1];
+}
+
+function profileExistsCommand(remote: RemoteHost, profile: string) {
+  if (profile === "default") return "true";
+  const check = `test -f ${piAgentDirectoryExpression(remote.piAgentDirectory)}/profiles/${shellQuote(profile)}/settings.json`;
+  if (remote.runtime === "host") return check;
+  if (!remote.container) fail("docker remote is missing its container name.");
+  return `docker exec ${shellQuote(remote.container)} sh -lc ${shellQuote(check)}`;
+}
+
+async function connectRemote(root: string, name: string, args: string[]) {
+  const store = await readStore(root);
+  const remote = store.remotes[name];
+  if (!remote) fail(`remote '${name}' does not exist.`);
+  const secrets = await readSecrets(root);
+  const password = secrets.passwords[name] ?? "";
+  const profile = requestedProfile(args);
+  if (profile) {
+    const exists = await runSsh(root, remote, password, profileExistsCommand(remote, profile));
+    if (exists.code !== 0) fail(`profile '${profile}' does not exist on remote '${name}'.`);
+  }
+  const command = args[0] === "bash"
+    ? runtimeBashCommand(remote, args.slice(1))
+    : profile && profileResourceCommands.has(args[2] ?? "")
+      ? profileRuntimeCommand(remote, profile, args.slice(2))
+      : runtimeCommand(remote, args);
+  const result = await runSsh(root, remote, password, command, { interactive: true });
+  process.exit(result.code);
+}
+
+export async function handleRemoteCli(args: string[], root: string): Promise<boolean> {
+  const remoteTarget = args[0]?.match(/^remote:([a-zA-Z][a-zA-Z0-9_-]{0,63})$/);
+  if (remoteTarget) {
+    await connectRemote(root, remoteTarget[1], args.slice(1));
+    return true;
+  }
+  if (args[0] !== "remote") return false;
+  const action = args[1];
+  if (action === "add" && args.length === 3) await addRemote(root, args[2]);
+  else if (action === "list" && args.length === 2) await listRemotes(root);
+  else if (action === "delete" && (args.length === 3 || (args.length === 4 && args[3] === "--force"))) await deleteRemote(root, args[2], args[3] === "--force");
+  else fail("usage: pi remote add <name> | pi remote list | pi remote delete <name> --force | pi remote:<name> [pi arguments]");
+  return true;
+}

package/extensions/pi-console-webui/app/[section]/page.tsx

@@ -0,0 +1,4 @@
+import { notFound } from "next/navigation";
+import { ConsolePage } from "@/components/console-page";
+const sections = new Set(["chat", "profiles", "settings", "env", "soul", "guardrails", "skills", "tools", "packages", "pulses", "extensions", "applications", "api-server", "pi-console-webui", "skill-sources"]);
+export default async function SectionPage({ params, searchParams }: { params: Promise<{ section: string }>; searchParams: Promise<{ profile?: string }> }) { const { section } = await params; if (!sections.has(section)) notFound(); return <ConsolePage section={section} profile={(await searchParams).profile}/>; }

package/extensions/pi-console-webui/app/api/admin/config/[target]/route.ts

@@ -0,0 +1,5 @@
+import { NextResponse } from "next/server";
+import { authenticated } from "@/lib/auth";
+import { isAdminTarget, readAdminConfig, writeAdminConfig } from "@/lib/admin-config";
+export async function GET(_: Request, { params }: { params: Promise<{ target: string }> }) { if (!(await authenticated())) return NextResponse.json({ error: "Unauthorized" }, { status: 401 }); const { target } = await params; if (!isAdminTarget(target)) return NextResponse.json({ error: "Not found" }, { status: 404 }); return NextResponse.json({ config: await readAdminConfig(target) }); }
+export async function PUT(request: Request, { params }: { params: Promise<{ target: string }> }) { if (!(await authenticated())) return NextResponse.json({ error: "Unauthorized" }, { status: 401 }); const { target } = await params; if (!isAdminTarget(target)) return NextResponse.json({ error: "Not found" }, { status: 404 }); try { return NextResponse.json({ config: await writeAdminConfig(target, await request.json()) }); } catch (error) { return NextResponse.json({ error: error instanceof Error ? error.message : "Invalid configuration" }, { status: 400 }); } }

package/extensions/pi-console-webui/app/api/admin/services/[service]/restart/route.ts

@@ -0,0 +1,5 @@
+import { spawn } from "node:child_process";
+import { NextResponse } from "next/server";
+import { authenticated } from "@/lib/auth";
+const commands = { "api-server": ["api", "restart"], "pi-console-webui": ["console", "restart"] } as const;
+export async function POST(_: Request, { params }: { params: Promise<{ service: string }> }) { if (!(await authenticated())) return NextResponse.json({ error: "Unauthorized" }, { status: 401 }); const { service } = await params; if (!(service in commands)) return NextResponse.json({ error: "Not found" }, { status: 404 }); const child = spawn("pi", commands[service as keyof typeof commands], { detached: true, stdio: "ignore", env: process.env }); child.unref(); return NextResponse.json({ ok: true }, { status: 202 }); }

package/extensions/pi-console-webui/app/api/auth/login/route.ts

@@ -0,0 +1,9 @@
+import { NextResponse } from "next/server";
+import { authToken, COOKIE, loginValid } from "@/lib/auth";
+export async function POST(request: Request) {
+  const body = await request.json().catch(() => ({}));
+  if (typeof body.username !== "string" || typeof body.password !== "string" || !(await loginValid(body.username, body.password))) return NextResponse.json({ error: "Invalid credentials" }, { status: 401 });
+  const response = NextResponse.json({ ok: true });
+  response.cookies.set(COOKIE, await authToken(), { httpOnly: true, sameSite: "strict", secure: process.env.PI_CONSOLE_HTTPS === "1", path: "/", maxAge: 60 * 60 * 12 });
+  return response;
+}

package/extensions/pi-console-webui/app/api/auth/logout/route.ts

@@ -0,0 +1,3 @@
+import { NextResponse } from "next/server";
+import { COOKIE } from "@/lib/auth";
+export async function POST() { const response = NextResponse.json({ ok: true }); response.cookies.set(COOKIE, "", { path: "/", maxAge: 0 }); return response; }

package/extensions/pi-console-webui/app/api/message/app/[slug]/route.ts

@@ -0,0 +1,11 @@
+import { NextResponse } from "next/server";
+import { getConfig } from "@/lib/config";
+
+const hopByHopHeaders = new Set(["connection", "content-length", "host", "keep-alive", "proxy-authenticate", "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade"]);
+export async function POST(request: Request, context: { params: Promise<{ slug: string }> }) {
+  const { slug } = await context.params; const config = await getConfig();
+  const url = new URL(`/api/message/app/${encodeURIComponent(slug)}`, config.apiUrl); url.search = new URL(request.url).search;
+  const headers = new Headers(); for (const [name, value] of request.headers) if (!hopByHopHeaders.has(name.toLowerCase())) headers.set(name, value);
+  try { const body = await request.arrayBuffer(); const response = await fetch(url, { method: "POST", headers, body: body.byteLength ? body : undefined, cache: "no-store" }); const responseHeaders = new Headers(); for (const name of ["content-type", "cache-control"]) { const value = response.headers.get(name); if (value) responseHeaders.set(name, value); } return new Response(response.body, { status: response.status, headers: responseHeaders }); }
+  catch { return NextResponse.json({ error: "Pi API is unavailable." }, { status: 503 }); }
+}

package/extensions/pi-console-webui/app/api/pi/[...path]/route.ts

@@ -0,0 +1,31 @@
+import { NextResponse } from "next/server";
+import { authenticated } from "@/lib/auth";
+import { getConfig } from "@/lib/config";
+
+async function proxy(request: Request, context: { params: Promise<{ path: string[] }> }) {
+  if (!(await authenticated())) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  const { path } = await context.params;
+  const config = await getConfig();
+  if (!config.apiToken) return NextResponse.json({ error: "Pi API token is not configured" }, { status: 503 });
+  const prefix = path[0] === "profile" ? "/" : "/api/";
+  const url = new URL(`${prefix}${path.map(encodeURIComponent).join("/")}`, config.apiUrl);
+  url.search = new URL(request.url).search;
+  const headers = new Headers({ authorization: `Bearer ${config.apiToken}` });
+  const contentType = request.headers.get("content-type");
+  const method = request.method;
+  try {
+    const payload = ["GET", "HEAD"].includes(method) ? undefined : await request.arrayBuffer();
+    if (contentType && payload && payload.byteLength > 0) headers.set("content-type", contentType);
+    const response = await fetch(url, { method, headers, body: payload && payload.byteLength > 0 ? payload : undefined, cache: "no-store" });
+    const responseHeaders = new Headers();
+    for (const name of ["content-type", "cache-control"]) { const value = response.headers.get(name); if (value) responseHeaders.set(name, value); }
+    return new Response(response.body, { status: response.status, headers: responseHeaders });
+  } catch {
+    return NextResponse.json({ error: "Pi API is unavailable. Start it with: pi api start" }, { status: 503 });
+  }
+}
+export const GET = proxy;
+export const POST = proxy;
+export const PUT = proxy;
+export const PATCH = proxy;
+export const DELETE = proxy;

package/extensions/pi-console-webui/app/applications/[slug]/page.tsx

@@ -0,0 +1,2 @@
+import { ConsolePage } from "@/components/console-page";
+export default async function ApplicationPage({ params }: { params: Promise<{ slug: string }> }) { return <ConsolePage section="applications" applicationSlug={(await params).slug}/>; }

package/extensions/pi-console-webui/app/globals.css

@@ -0,0 +1,41 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+:root { color-scheme: light; }
+* { box-sizing: border-box; }
+body { margin: 0; min-height: 100vh; background: #f8fafc; color: #18181b; font-family: Arial, sans-serif; }
+body:has(.terminal-page) { background: #0d1117; }
+.terminal-page { background: #0d1117 !important; color: #e6edf3 !important; }
+.terminal-header { border-bottom: 1px solid #30363d; background: #161b22; color: #e6edf3; }
+.terminal-header span:last-child { color: #8b949e; }
+.terminal-screen { position: relative; min-width: 0; overflow: hidden; background: #0d1117; }
+.terminal-host { position: absolute; inset: 16px 16px 28px; min-width: 0; min-height: 0; overflow: hidden; }
+.terminal-host .xterm { width: 100%; max-width: 100%; height: 100%; overflow: hidden; }
+.terminal-host .xterm-viewport { background-color: #0d1117 !important; }
+button, input, textarea, select { font: inherit; }
+select, select option { background-color: #ffffff !important; }
+.bg-zinc-950, .bg-zinc-900 { background-color: #ffffff !important; }
+.bg-zinc-800 { background-color: #e4e4e7 !important; }
+.border-zinc-800, .border-zinc-700 { border-color: #d4d4d8 !important; }
+.text-zinc-400, .text-zinc-300 { color: #52525b !important; }
+.text-amber-300 { color: #a16207 !important; }
+.bg-red-950 { background-color: #fef2f2 !important; }
+.text-red-300 { color: #b91c1c !important; }
+.log-json { margin: 0; max-height: 320px; overflow: auto; white-space: pre-wrap; border: 1px solid #d4d4d8; border-radius: .5rem; background: #f4f4f5 !important; color: #18181b !important; padding: .75rem; font-size: .75rem; line-height: 1.35; }
+.log-hover-json { border-color: #b9e6e8; background: rgb(246 253 255 / .88) !important; }
+.handler-test-logs { margin: 1rem 0 0; min-height: 7rem; overflow: auto; border: 1px solid #d4d4d8; border-radius: .5rem; background: #ffffff !important; color: #18181b !important; padding: 1rem; font-size: .75rem; line-height: 1.5; white-space: pre-wrap; }
+.json-view .cm-editor { max-height: 320px; overflow: auto; background: #fff; font-size: .75rem; }
+.json-view .cm-scroller { overflow: auto; }
+.json-view .cm-gutters { display: none; }
+.json-view .cm-content { padding: .75rem; }
+.json-view .cm-activeLine, .json-view .cm-activeLineGutter { background-color: transparent !important; }
+.skill-markdown { overflow-x: auto; }
+.skill-markdown table { width: 100%; min-width: 860px; border-collapse: separate; border-spacing: 0; overflow: hidden; border: 1px solid #e4e4e7; border-radius: .625rem; font-size: .875rem; line-height: 1.5; }
+.skill-markdown thead { background: #f4f4f5; }
+.skill-markdown th { padding: .75rem 1rem; border-bottom: 1px solid #d4d4d8; color: #3f3f46; font-weight: 650; text-align: left; vertical-align: bottom; }
+.skill-markdown td { padding: .75rem 1rem; border-bottom: 1px solid #e4e4e7; color: #27272a; text-align: left; vertical-align: top; overflow-wrap: anywhere; }
+.skill-markdown tbody tr:nth-child(even) { background: #fafafa; }
+.skill-markdown tbody tr:last-child td { border-bottom: 0; }
+.skill-markdown th:not(:last-child), .skill-markdown td:not(:last-child) { border-right: 1px solid #e4e4e7; }
+.skill-markdown table code { white-space: nowrap; font-size: .8em; }

package/extensions/pi-console-webui/app/icon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="14" fill="#406889"/><text x="32" y="45" text-anchor="middle" font-family="Georgia,serif" font-size="48" font-weight="bold" fill="white">π</text></svg>

package/extensions/pi-console-webui/app/layout.tsx

@@ -0,0 +1,5 @@
+import "./globals.css";
+import { ToastProvider } from "@/components/toast";
+import { ConsoleStateProvider } from "@/components/console-state";
+export const metadata = { title: "Pi Console", description: "Pi API console" };
+export default function Layout({ children }: Readonly<{ children: React.ReactNode }>) { return <html lang="pt-BR"><body><ToastProvider><ConsoleStateProvider>{children}</ConsoleStateProvider></ToastProvider></body></html>; }

package/extensions/pi-console-webui/app/login/page.tsx

@@ -0,0 +1,11 @@
+"use client";
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Loader2 } from "lucide-react";
+export default function Login() {
+  const router = useRouter(); const [username, setUsername] = useState(""), [password, setPassword] = useState(""), [error, setError] = useState(""), [loading, setLoading] = useState(false);
+  async function submit(event: React.FormEvent) { event.preventDefault(); if (loading) return; setError(""); setLoading(true); try { const response = await fetch("/api/auth/login", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ username, password }) }); if (response.ok) router.push("/"); else { setError("Invalid credentials."); window.setTimeout(() => setError(""), 4_000); } } catch { setError("Unable to sign in."); window.setTimeout(() => setError(""), 4_000); } finally { setLoading(false); } }
+  return <main className="grid min-h-screen place-items-center p-4"><form onSubmit={submit} className="w-full max-w-sm space-y-4 rounded-xl border border-zinc-800 bg-zinc-950 p-6 shadow-xl"><h1 className="text-2xl font-bold">Pi Console</h1><p className="text-sm text-zinc-400">Sign in to manage Pi.</p><Input value={username} onChange={(e) => setUsername(e.target.value)} placeholder="Username" autoFocus /><Input value={password} onChange={(e) => setPassword(e.target.value)} type="password" placeholder="Password" />{error && <p className="text-sm text-red-400">{error}</p>}<Button className="w-full" disabled={loading}>{loading ? <><Loader2 className="mr-2 animate-spin" size={16}/>Signing in…</> : "Sign in"}</Button></form></main>;
+}

package/extensions/pi-console-webui/app/page.tsx

@@ -0,0 +1,2 @@
+import { ConsolePage } from "@/components/console-page";
+export default async function Page({ searchParams }: { searchParams: Promise<{ profile?: string }> }) { return <ConsolePage section="overview" profile={(await searchParams).profile}/>; }

package/extensions/pi-console-webui/app/terminal/page.tsx

@@ -0,0 +1,4 @@
+import { redirect } from "next/navigation";
+import { authenticated } from "@/lib/auth";
+import { TerminalClient } from "@/components/terminal-client";
+export default async function TerminalPage() { if (!(await authenticated())) redirect("/login"); return <TerminalClient/>; }

package/extensions/pi-console-webui/components/admin-config-form.tsx

@@ -0,0 +1,16 @@
+"use client";
+import { useState } from "react";
+import { Loader2, RotateCw, Save } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Card, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { useToast } from "@/components/toast";
+
+type Target = "api-server" | "pi-console-webui";
+export function AdminConfigForm({ target, initial }: { target: Target; initial?: Record<string, unknown> }) {
+  const { toast } = useToast(); const api = target === "api-server";
+  const [host, setHost] = useState(String(initial?.host ?? (api ? "0.0.0.0" : "127.0.0.1"))); const [port, setPort] = useState(String(initial?.port ?? (api ? 8767 : 3030))); const [username, setUsername] = useState(String(initial?.username ?? "admin")); const [password, setPassword] = useState(String(initial?.password ?? "")); const [secret, setSecret] = useState(String(initial?.secret ?? "")); const [corsOrigin, setCorsOrigin] = useState(String((initial?.cors as { origin?: string } | undefined)?.origin ?? "*")); const [apiToken, setApiToken] = useState(""); const [saving, setSaving] = useState(false), [restarting, setRestarting] = useState(false);
+  const save = async () => { if (saving) return; try { setSaving(true); const config: Record<string, unknown> = api ? { host, port: Number(port), cors: { origin: corsOrigin } } : { host, port: Number(port), username, password, secret }; if (apiToken) config.apiToken = apiToken; const response = await fetch(`/api/admin/config/${target}`, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify(config) }); if (!response.ok) throw new Error((await response.json()).error ?? "Unable to save configuration"); toast("Configuration saved."); } catch (cause) { toast((cause as Error).message, "error"); } finally { setSaving(false); } };
+  const restart = async () => { if (restarting) return; try { setRestarting(true); const response = await fetch(`/api/admin/services/${target}/restart`, { method: "POST" }); if (!response.ok) throw new Error("Unable to restart service"); toast("Service restart requested."); } catch (cause) { toast((cause as Error).message, "error"); } finally { setRestarting(false); } };
+  return <Card><div className="flex items-center justify-between gap-3"><div><CardTitle>{api ? "API Server" : "Pi Console WebUI"}</CardTitle><p className="text-sm text-zinc-500">Update service settings and restart to apply changes.</p></div><div className="flex gap-2"><Button className="bg-zinc-100 text-zinc-700 hover:bg-zinc-200" title="Restart service" disabled={restarting} onClick={restart}>{restarting ? <Loader2 className="animate-spin" size={17}/> : <RotateCw size={17}/>}</Button><Button className="!bg-[#2bbb77] hover:!bg-[#249b63]" title="Save configuration" disabled={saving} onClick={save}>{saving ? <Loader2 className="animate-spin" size={17}/> : <Save size={17}/>}</Button></div></div><div className="mt-5 grid gap-4 md:grid-cols-2"><label className="text-sm font-medium">Host<Input className="mt-1" value={host} onChange={(event) => setHost(event.target.value)}/></label><label className="text-sm font-medium">Port<Input className="mt-1" type="number" min="1" max="65535" value={port} onChange={(event) => setPort(event.target.value)}/></label>{api ? <><label className="text-sm font-medium md:col-span-2">CORS origin<Input className="mt-1" value={corsOrigin} onChange={(event) => setCorsOrigin(event.target.value)}/></label><label className="text-sm font-medium md:col-span-2">Replace API token <span className="font-normal text-zinc-500">(leave blank to keep current token)</span><Input className="mt-1" type="password" value={apiToken} onChange={(event) => setApiToken(event.target.value)} placeholder="New API token"/></label></> : <><label className="text-sm font-medium">Username<Input className="mt-1" value={username} onChange={(event) => setUsername(event.target.value)}/></label><label className="text-sm font-medium">Password<Input className="mt-1" type="password" value={password} onChange={(event) => setPassword(event.target.value)}/></label><label className="text-sm font-medium md:col-span-2">Session secret<Input className="mt-1" value={secret} onChange={(event) => setSecret(event.target.value)}/></label></>}</div></Card>;
+}