pi-oxidized 0.1.1

package/.references/pi/scripts/build-binaries.sh

@@ -0,0 +1,245 @@
+#!/usr/bin/env bash
+#
+# Build pi binaries for all platforms locally.
+# Mirrors .github/workflows/build-binaries.yml
+#
+# Usage:
+#   ./scripts/build-binaries.sh [--skip-install] [--skip-deps] [--skip-build] [--platform <platform>] [--out <dir>]
+#
+# Options:
+#   --skip-install      Skip npm ci
+#   --skip-deps         Skip installing cross-platform dependencies
+#   --skip-build        Skip npm run build
+#   --platform <name>   Build only for specified platform (darwin-arm64, darwin-x64, linux-x64, linux-arm64, windows-x64, windows-arm64)
+#   --out <dir>         Output directory (default: packages/coding-agent/binaries)
+#
+# Output:
+#   packages/coding-agent/binaries/
+#     pi-darwin-arm64.tar.gz
+#     pi-darwin-x64.tar.gz
+#     pi-linux-x64.tar.gz
+#     pi-linux-arm64.tar.gz
+#     pi-windows-x64.zip
+#     pi-windows-arm64.zip
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+SKIP_INSTALL=false
+SKIP_DEPS=false
+SKIP_BUILD=false
+PLATFORM=""
+OUTPUT_DIR=""
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --skip-install)
+            SKIP_INSTALL=true
+            shift
+            ;;
+        --skip-deps)
+            SKIP_DEPS=true
+            shift
+            ;;
+        --skip-build)
+            SKIP_BUILD=true
+            shift
+            ;;
+        --platform)
+            PLATFORM="$2"
+            shift 2
+            ;;
+        --out)
+            OUTPUT_DIR="$2"
+            shift 2
+            ;;
+        *)
+            echo "Unknown option: $1"
+            exit 1
+            ;;
+    esac
+done
+
+# Validate platform if specified
+if [[ -n "$PLATFORM" ]]; then
+    case "$PLATFORM" in
+        darwin-arm64|darwin-x64|linux-x64|linux-arm64|windows-x64|windows-arm64)
+            ;;
+        *)
+            echo "Invalid platform: $PLATFORM"
+            echo "Valid platforms: darwin-arm64, darwin-x64, linux-x64, linux-arm64, windows-x64, windows-arm64"
+            exit 1
+            ;;
+    esac
+fi
+
+if [[ -z "$OUTPUT_DIR" ]]; then
+    OUTPUT_DIR="packages/coding-agent/binaries"
+fi
+if [[ "$OUTPUT_DIR" != /* ]]; then
+    OUTPUT_DIR="$(pwd)/$OUTPUT_DIR"
+fi
+
+if [[ "$SKIP_INSTALL" == "false" ]]; then
+    echo "==> Installing dependencies..."
+    npm ci --ignore-scripts
+else
+    echo "==> Skipping npm ci (--skip-install)"
+fi
+
+if [[ "$SKIP_DEPS" == "false" ]]; then
+    echo "==> Installing cross-platform native bindings..."
+    CLIPBOARD_VERSION=$(node -p "require('./packages/coding-agent/package.json').optionalDependencies['@mariozechner/clipboard']")
+    # npm ci only installs optional deps for the current platform
+    # We need the base clipboard package and all platform bindings for bun cross-compilation
+    # Use --force to bypass platform checks (os/cpu restrictions in package.json)
+    # Install all in one command to avoid npm removing packages from previous installs
+    npm install --include=optional --no-save --package-lock=false --force --ignore-scripts \
+        @mariozechner/clipboard@"$CLIPBOARD_VERSION" \
+        @mariozechner/clipboard-darwin-arm64@"$CLIPBOARD_VERSION" \
+        @mariozechner/clipboard-darwin-x64@"$CLIPBOARD_VERSION" \
+        @mariozechner/clipboard-linux-x64-gnu@"$CLIPBOARD_VERSION" \
+        @mariozechner/clipboard-linux-arm64-gnu@"$CLIPBOARD_VERSION" \
+        @mariozechner/clipboard-win32-x64-msvc@"$CLIPBOARD_VERSION" \
+        @mariozechner/clipboard-win32-arm64-msvc@"$CLIPBOARD_VERSION"
+else
+    echo "==> Skipping cross-platform native bindings (--skip-deps)"
+fi
+
+if [[ "$SKIP_BUILD" == "false" ]]; then
+    echo "==> Building all packages..."
+    npm run build
+else
+    echo "==> Skipping package build (--skip-build)"
+fi
+
+echo "==> Building binaries..."
+cd packages/coding-agent
+
+# Clean previous builds
+rm -rf "$OUTPUT_DIR"
+mkdir -p "$OUTPUT_DIR"/{darwin-arm64,darwin-x64,linux-x64,linux-arm64,windows-x64,windows-arm64}
+
+# Determine which platforms to build
+if [[ -n "$PLATFORM" ]]; then
+    PLATFORMS=("$PLATFORM")
+else
+    PLATFORMS=(darwin-arm64 darwin-x64 linux-x64 linux-arm64 windows-x64 windows-arm64)
+fi
+
+for platform in "${PLATFORMS[@]}"; do
+    echo "Building for $platform..."
+    # Bun compiled executables only embed worker scripts when they are passed as
+    # explicit build entrypoints. The runtime can still use new URL(...), but the
+    # worker must be present in the compiled executable.
+    if [[ "$platform" == windows-* ]]; then
+        bun build --compile --target=bun-$platform ./dist/bun/cli.js ./src/utils/image-resize-worker.ts --outfile "$OUTPUT_DIR/$platform/pi.exe"
+    else
+        bun build --compile --target=bun-$platform ./dist/bun/cli.js ./src/utils/image-resize-worker.ts --outfile "$OUTPUT_DIR/$platform/pi"
+    fi
+done
+
+echo "==> Creating release archives..."
+
+# Copy shared files to each platform directory
+for platform in "${PLATFORMS[@]}"; do
+    cp package.json "$OUTPUT_DIR/$platform/"
+    cp README.md "$OUTPUT_DIR/$platform/"
+    cp CHANGELOG.md "$OUTPUT_DIR/$platform/"
+    cp ../../node_modules/@silvia-odwyer/photon-node/photon_rs_bg.wasm "$OUTPUT_DIR/$platform/"
+    mkdir -p "$OUTPUT_DIR/$platform/theme"
+    cp dist/modes/interactive/theme/*.json "$OUTPUT_DIR/$platform/theme/"
+    mkdir -p "$OUTPUT_DIR/$platform/assets"
+    cp dist/modes/interactive/assets/* "$OUTPUT_DIR/$platform/assets/"
+    cp -r dist/core/export-html "$OUTPUT_DIR/$platform/"
+    cp -r docs "$OUTPUT_DIR/$platform/"
+    cp -r examples "$OUTPUT_DIR/$platform/"
+
+    case "$platform" in
+        darwin-arm64)
+            clipboard_native_package="clipboard-darwin-arm64"
+            clipboard_native_file="clipboard.darwin-arm64.node"
+            ;;
+        darwin-x64)
+            clipboard_native_package="clipboard-darwin-x64"
+            clipboard_native_file="clipboard.darwin-x64.node"
+            ;;
+        linux-x64)
+            clipboard_native_package="clipboard-linux-x64-gnu"
+            clipboard_native_file="clipboard.linux-x64-gnu.node"
+            ;;
+        linux-arm64)
+            clipboard_native_package="clipboard-linux-arm64-gnu"
+            clipboard_native_file="clipboard.linux-arm64-gnu.node"
+            ;;
+        windows-x64)
+            clipboard_native_package="clipboard-win32-x64-msvc"
+            clipboard_native_file="clipboard.win32-x64-msvc.node"
+            ;;
+        windows-arm64)
+            clipboard_native_package="clipboard-win32-arm64-msvc"
+            clipboard_native_file="clipboard.win32-arm64-msvc.node"
+            ;;
+    esac
+    mkdir -p "$OUTPUT_DIR/$platform/node_modules/@mariozechner"
+    cp -r ../../node_modules/@mariozechner/clipboard "$OUTPUT_DIR/$platform/node_modules/@mariozechner/"
+    cp -r ../../node_modules/@mariozechner/$clipboard_native_package "$OUTPUT_DIR/$platform/node_modules/@mariozechner/"
+    cp "../../node_modules/@mariozechner/$clipboard_native_package/$clipboard_native_file" \
+        "$OUTPUT_DIR/$platform/node_modules/@mariozechner/clipboard/"
+
+    # Copy terminal input native helpers next to compiled binaries.
+    if [[ "$platform" == darwin-* ]]; then
+        mkdir -p "$OUTPUT_DIR/$platform/native/darwin/prebuilds/$platform"
+        cp ../tui/native/darwin/prebuilds/$platform/darwin-modifiers.node "$OUTPUT_DIR/$platform/native/darwin/prebuilds/$platform/"
+    fi
+    if [[ "$platform" == windows-* ]]; then
+        if [[ "$platform" == "windows-arm64" ]]; then
+            win32_arch_dir="win32-arm64"
+        else
+            win32_arch_dir="win32-x64"
+        fi
+        mkdir -p "$OUTPUT_DIR/$platform/native/win32/prebuilds/$win32_arch_dir"
+        cp ../tui/native/win32/prebuilds/$win32_arch_dir/win32-console-mode.node "$OUTPUT_DIR/$platform/native/win32/prebuilds/$win32_arch_dir/"
+    fi
+done
+
+# Create archives
+cd "$OUTPUT_DIR"
+
+for platform in "${PLATFORMS[@]}"; do
+    if [[ "$platform" == windows-* ]]; then
+        # Windows (zip)
+        echo "Creating pi-$platform.zip..."
+        (cd "$platform" && zip -r ../pi-$platform.zip .)
+    else
+        # Unix platforms (tar.gz) - use wrapper directory for mise compatibility
+        echo "Creating pi-$platform.tar.gz..."
+        mv "$platform" pi && tar -czf pi-$platform.tar.gz pi && mv pi "$platform"
+    fi
+done
+
+# Extract archives for easy local testing
+echo "==> Extracting archives for testing..."
+for platform in "${PLATFORMS[@]}"; do
+    rm -rf "$platform"
+    if [[ "$platform" == windows-* ]]; then
+        mkdir -p "$platform" && (cd "$platform" && unzip -q ../pi-$platform.zip)
+    else
+        tar -xzf pi-$platform.tar.gz && mv pi "$platform"
+    fi
+done
+
+echo ""
+echo "==> Build complete!"
+echo "Archives available in $OUTPUT_DIR/"
+ls -lh *.tar.gz *.zip 2>/dev/null || true
+echo ""
+echo "Extracted directories for testing:"
+for platform in "${PLATFORMS[@]}"; do
+    if [[ "$platform" == windows-* ]]; then
+        echo "  $OUTPUT_DIR/$platform/pi.exe"
+    else
+        echo "  $OUTPUT_DIR/$platform/pi"
+    fi
+done

package/.references/pi/scripts/check-browser-smoke.mjs

@@ -0,0 +1,36 @@
+import { writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { build } from "esbuild";
+
+const outputPath = join(tmpdir(), "pi-browser-smoke.js");
+const errorLogPath = join(tmpdir(), "pi-browser-smoke-errors.log");
+
+try {
+	await build({
+		entryPoints: ["scripts/browser-smoke-entry.ts"],
+		bundle: true,
+		platform: "browser",
+		format: "esm",
+		logLevel: "silent",
+		outfile: outputPath,
+	});
+	process.exit(0);
+} catch (error) {
+	let detailedErrors = "";
+	if (error && typeof error === "object" && "errors" in error && Array.isArray(error.errors)) {
+		detailedErrors = error.errors
+			.map((entry) => {
+				const location = entry.location
+					? `${entry.location.file}:${entry.location.line}:${entry.location.column}`
+					: "";
+				return [location, entry.text].filter(Boolean).join(" ");
+			})
+			.join("\n");
+	}
+
+	const baseError = error instanceof Error ? (error.stack ?? error.message) : String(error);
+	writeFileSync(errorLogPath, [detailedErrors, baseError].filter(Boolean).join("\n\n"), "utf-8");
+	console.error(`Browser smoke check failed. See ${errorLogPath}`);
+	process.exit(1);
+}

package/.references/pi/scripts/check-lockfile-commit.mjs

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+
+const allowValue = process.env.PI_ALLOW_LOCKFILE_CHANGE;
+const allowed = allowValue === "1" || allowValue === "true" || allowValue === "yes";
+
+function git(args) {
+	return execFileSync("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}
+
+function readJsonFromGit(ref) {
+	try {
+		return JSON.parse(git(["show", ref]));
+	} catch {
+		return undefined;
+	}
+}
+
+function packageNameFromLockPath(lockPath) {
+	const marker = "node_modules/";
+	const index = lockPath.lastIndexOf(marker);
+	if (index === -1) return lockPath || "<root>";
+	const parts = lockPath.slice(index + marker.length).split("/");
+	return parts[0]?.startsWith("@") ? `${parts[0]}/${parts[1]}` : parts[0];
+}
+
+function packageLabel(lockPath, entry) {
+	const name = entry?.name ?? packageNameFromLockPath(lockPath);
+	return entry?.version ? `${name}@${entry.version}` : name;
+}
+
+function getLockfilePackageChanges() {
+	const before = readJsonFromGit("HEAD:package-lock.json");
+	const after = readJsonFromGit(":package-lock.json");
+	if (!before?.packages || !after?.packages) return undefined;
+
+	const changes = [];
+	const paths = new Set([...Object.keys(before.packages), ...Object.keys(after.packages)]);
+	for (const lockPath of [...paths].sort()) {
+		const oldEntry = before.packages[lockPath];
+		const newEntry = after.packages[lockPath];
+		if (JSON.stringify(oldEntry) !== JSON.stringify(newEntry)) {
+			changes.push({ lockPath, oldEntry, newEntry });
+		}
+	}
+	return changes;
+}
+
+function isWorkspacePackagePath(lockPath) {
+	return lockPath.startsWith("packages/");
+}
+
+function hasOnlyWorkspacePackageChanges(changes) {
+	return changes.length > 0 && changes.every((change) => isWorkspacePackagePath(change.lockPath));
+}
+
+function summarizeLockfileChange(changes) {
+	const nodeModuleChanges = changes.filter((change) => change.lockPath.includes("node_modules/"));
+	const summary = [];
+	for (const { lockPath, oldEntry, newEntry } of nodeModuleChanges) {
+		if (!oldEntry && newEntry) {
+			summary.push(`added ${packageLabel(lockPath, newEntry)}`);
+		} else if (oldEntry && !newEntry) {
+			summary.push(`removed ${packageLabel(lockPath, oldEntry)}`);
+		} else if (oldEntry?.version !== newEntry?.version) {
+			summary.push(
+				`changed ${packageNameFromLockPath(lockPath)} ${oldEntry?.version ?? "<none>"} -> ${newEntry?.version ?? "<none>"}`,
+			);
+		} else {
+			summary.push(`changed ${packageLabel(lockPath, newEntry)}`);
+		}
+	}
+	return summary;
+}
+
+const stagedFiles = git(["diff", "--cached", "--name-only"])
+	.split("\n")
+	.map((line) => line.trim())
+	.filter(Boolean);
+
+if (!stagedFiles.includes("package-lock.json")) {
+	process.exit(0);
+}
+
+if (allowed) {
+	console.error("package-lock.json is staged; PI_ALLOW_LOCKFILE_CHANGE is set, allowing commit.");
+	process.exit(0);
+}
+
+const changes = getLockfilePackageChanges();
+if (changes && hasOnlyWorkspacePackageChanges(changes)) {
+	console.error("package-lock.json only updates workspace package metadata; allowing commit.");
+	process.exit(0);
+}
+
+console.error("package-lock.json is staged.");
+console.error("");
+console.error("Review lockfile changes before committing:");
+console.error("  - confirm every new/updated package is intentional");
+console.error("  - confirm npm age gates were active for resolution");
+console.error("  - review any new lifecycle scripts in the dependency tree");
+console.error("  - regenerate/check coding-agent shrinkwrap if release deps changed");
+
+const summary = changes ? summarizeLockfileChange(changes) : [];
+if (summary.length > 0) {
+	console.error("");
+	console.error("Detected package version changes:");
+	for (const change of summary.slice(0, 40)) {
+		console.error(`  - ${change}`);
+	}
+	if (summary.length > 40) {
+		console.error(`  ... ${summary.length - 40} more`);
+	}
+}
+
+console.error("");
+console.error("If this lockfile change is intentional, commit with:");
+console.error("  PI_ALLOW_LOCKFILE_CHANGE=1 git commit ...");
+process.exit(1);

package/.references/pi/scripts/check-pinned-deps.mjs

@@ -0,0 +1,63 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const dependencySections = ["dependencies", "devDependencies", "optionalDependencies"];
+const exactVersionPattern = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const ignoredDirectories = new Set([".git", "dist", "node_modules"]);
+const packageJsonFiles = [];
+
+function collectPackageJsonFiles(directory) {
+	for (const entry of readdirSync(directory, { withFileTypes: true })) {
+		if (entry.isDirectory()) {
+			if (!ignoredDirectories.has(entry.name)) {
+				collectPackageJsonFiles(join(directory, entry.name));
+			}
+			continue;
+		}
+
+		if (entry.isFile() && entry.name === "package.json") {
+			packageJsonFiles.push(join(directory, entry.name));
+		}
+	}
+}
+
+function isInternalWorkspaceDependency(name) {
+	return name.startsWith("@earendil-works/pi-");
+}
+
+function isNonRegistrySpecifier(specifier) {
+	return /^(?:workspace:|file:|link:|portal:|git\+|github:|git:|https?:|ssh:|git:\/\/)/.test(specifier);
+}
+
+function getVersionSpecifier(specifier) {
+	if (!specifier.startsWith("npm:")) return specifier;
+	const aliasTarget = specifier.slice("npm:".length);
+	const versionSeparator = aliasTarget.lastIndexOf("@");
+	if (versionSeparator <= 0) return specifier;
+	return aliasTarget.slice(versionSeparator + 1);
+}
+
+const failures = [];
+
+collectPackageJsonFiles(".");
+
+for (const file of packageJsonFiles.sort()) {
+	const packageJson = JSON.parse(readFileSync(file, "utf8"));
+
+	for (const section of dependencySections) {
+		const dependencies = packageJson[section];
+		if (!dependencies) continue;
+
+		for (const [name, specifier] of Object.entries(dependencies)) {
+			if (isInternalWorkspaceDependency(name) || isNonRegistrySpecifier(specifier)) continue;
+			if (exactVersionPattern.test(getVersionSpecifier(specifier))) continue;
+			failures.push(`${file}: ${section}.${name} must be pinned, found ${specifier}`);
+		}
+	}
+}
+
+if (failures.length > 0) {
+	console.error("Direct external dependencies must use exact versions:");
+	for (const failure of failures) console.error(`  ${failure}`);
+	process.exit(1);
+}

package/.references/pi/scripts/check-ts-relative-imports.mjs

@@ -0,0 +1,74 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import ts from "typescript";
+
+const ignoredDirectories = new Set([".git", "coverage", "dist", "node_modules"]);
+const files = [];
+
+function collectTypescriptFiles(directory) {
+	for (const entry of readdirSync(directory, { withFileTypes: true })) {
+		if (entry.isDirectory()) {
+			if (!ignoredDirectories.has(entry.name)) {
+				collectTypescriptFiles(join(directory, entry.name));
+			}
+			continue;
+		}
+
+		if (entry.isFile() && entry.name.endsWith(".ts") && !entry.name.endsWith(".d.ts")) {
+			files.push(join(directory, entry.name));
+		}
+	}
+}
+
+function isRelativeJavaScriptSpecifier(specifier) {
+	return /^\.\.?\//.test(specifier) && /\.js(?:[?#].*)?$/.test(specifier);
+}
+
+function getImportTypeSpecifier(node) {
+	if (!ts.isLiteralTypeNode(node.argument)) return undefined;
+	if (!ts.isStringLiteralLike(node.argument.literal)) return undefined;
+	return node.argument.literal;
+}
+
+const failures = [];
+
+collectTypescriptFiles(".");
+
+for (const file of files.sort()) {
+	const sourceText = readFileSync(file, "utf8");
+	const sourceFile = ts.createSourceFile(file, sourceText, ts.ScriptTarget.Latest, true);
+
+	function checkSpecifier(node) {
+		if (!isRelativeJavaScriptSpecifier(node.text)) return;
+		const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+		failures.push(`${file}:${line + 1}:${character + 1}: ${node.text}`);
+	}
+
+	function visit(node) {
+		if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
+			checkSpecifier(node.moduleSpecifier);
+		} else if (ts.isExportDeclaration(node) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) {
+			checkSpecifier(node.moduleSpecifier);
+		} else if (
+			ts.isCallExpression(node) &&
+			node.expression.kind === ts.SyntaxKind.ImportKeyword &&
+			node.arguments[0] &&
+			ts.isStringLiteralLike(node.arguments[0])
+		) {
+			checkSpecifier(node.arguments[0]);
+		} else if (ts.isImportTypeNode(node)) {
+			const specifier = getImportTypeSpecifier(node);
+			if (specifier) checkSpecifier(specifier);
+		}
+
+		ts.forEachChild(node, visit);
+	}
+
+	visit(sourceFile);
+}
+
+if (failures.length > 0) {
+	console.error("Relative .js imports are not allowed in non-declaration .ts files:");
+	for (const failure of failures) console.error(`  ${failure}`);
+	process.exit(1);
+}