pi-roundtable-webchat 0.25.0 → 0.26.1

package/CHANGELOG.md

@@ -5,6 +5,14 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.26.1] - 2026-10-30
+
+- Release in lockstep with pi-roundtable 0.26.1; no package-specific behavior changes. The core peer range stays `>=0.26.0 <0.27.0`.
+
+## [0.26.0] - 2026-10-30
+
+The core peer range is now `>=0.26.0 <0.27.0`.
+
 ## [0.25.0] - 2026-10-29
 
 - Release in lockstep with pi-roundtable 0.25.0; no package-specific behavior changes. The core peer range is now `>=0.25.0 <0.26.0`.

package/README.md

@@ -21,7 +21,7 @@ It needs no Discord: a host whose `roundtable.config.ts` has no `discord` key an
 
 ## Requirements
 
-- Bun 1.4.4 or later, and pi-roundtable `>=0.25.0 <0.26.0` as a peer dependency. Uploading files needs `context.attachments`, which pi-roundtable added in 0.9.2: the plugin refuses to set up on an earlier core and names the version to install.
+- Bun 1.4.4 or later, and pi-roundtable `>=0.26.0 <0.27.0` as a peer dependency. Uploading files needs `context.attachments`, which pi-roundtable added in 0.9.2: the plugin refuses to set up on an earlier core and names the version to install.
 - An HTTP listener on the host (`http` in the configuration), behind a reverse proxy that serves it over HTTPS.
 - An OpenID Connect provider that issues access tokens for this API, with signing keys published as a JWKS.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-webchat",
-	"version": "0.25.0",
+	"version": "0.26.1",
 	"description": "A WebSocket chat adapter for pi-roundtable: private web conversations for people an OpenID Connect provider signs in, with live progress and approval cards",
 	"type": "module",
 	"license": "MIT",
@@ -38,14 +38,14 @@
 		"jose": "6.2.12"
 	},
 	"peerDependencies": {
-		"pi-roundtable": ">=0.25.0 <0.26.0"
+		"pi-roundtable": ">=0.26.0 <0.27.0"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.5.15",
 		"@earendil-works/pi-ai": ">=1.0.0 <2",
 		"@earendil-works/pi-coding-agent": ">=1.0.0 <2",
 		"@types/bun": "1.4.3",
-		"pi-roundtable": "0.25.0",
+		"pi-roundtable": "0.26.1",
 		"typebox": "1.3.37",
 		"typescript": "7.0.2"
 	}

package/src/oidc.ts

@@ -6,6 +6,7 @@ import {
 	jwtVerify,
 } from "jose";
 import type { ActorFacts } from "pi-roundtable";
+import { oidcIdentity, oidcProvider } from "pi-roundtable/kit";
 
 /** Who a verified token names, and until when it may be trusted. */
 export interface WebIdentity {
@@ -38,15 +39,13 @@ export class TokenRefused extends Error {
 	}
 }
 
-const PREFIX = "oidc";
-
 /**
  * The speaker id of an OpenID subject: `oidc:<base64url(issuer)>:<subject>`. The issuer is
  * encoded so its own colons stay apart from the subject's, and the id can be turned back into the
  * pair with `parseOidcSpeakerId`. It never looks like a Discord id.
  */
 export function oidcSpeakerId(issuer: string, subject: string): string {
-	return `${PREFIX}:${Buffer.from(issuer).toString("base64url")}:${subject}`;
+	return oidcIdentity(issuer, subject);
 }
 
 /** The issuer and subject of an id `oidcSpeakerId` made; undefined for any other id. */
@@ -79,9 +78,7 @@ export function identityActor(
 	const oidc = parseOidcSpeakerId(identity.id);
 	return {
 		...(identity.actor ?? {
-			provider: oidc
-				? `oidc:${Buffer.from(oidc.issuer).toString("base64url")}`
-				: surface,
+			provider: oidc ? oidcProvider(oidc.issuer) : surface,
 			subject: oidc?.subject ?? identity.id,
 			legacyId: identity.id,
 		}),
@@ -264,7 +261,7 @@ export function oidcJwtVerifier(
 			: [];
 		return {
 			actor: {
-				provider: `oidc:${Buffer.from(issuer).toString("base64url")}`,
+				provider: oidcProvider(issuer),
 				subject,
 				name,
 				surface: "web",

package/src/plugin.ts

@@ -1,5 +1,6 @@
 import {
 	CONVERSATIONS,
+	ConfigError,
 	definePlugin,
 	type HttpRoute,
 	IDENTITY,
@@ -9,6 +10,7 @@ import {
 	type WebSocketAccept,
 	type WebSocketRoute,
 } from "pi-roundtable";
+import { SHELL_TOOLS } from "pi-roundtable/kit";
 import {
 	type Admitted,
 	checkPersonas,
@@ -260,6 +262,9 @@ export function webChat(options: WebChatOptions): RoundtablePlugin {
 				throw new Error(
 					"webChat: this version keeps uploaded files with context.attachments, which pi-roundtable 0.9.2 added. Update pi-roundtable to 0.9.2 or later.",
 				);
+			// A chat-only host (pi-roundtable 0.26) withholds the shell from every turn; say so at start, not at the first turn.
+			if (context.env?.agentTools === "chat-only")
+				refuseShellPersonas(options.personas);
 			const chat = new WebChat({
 				surface,
 				...(options.formatting === undefined
@@ -409,3 +414,16 @@ export function webChat(options: WebChatOptions): RoundtablePlugin {
 		},
 	});
 }
+
+/** Refuses a persona whose own selection names a shell or file tool, which a chat-only host withholds. */
+function refuseShellPersonas(personas: readonly WebPersona[]): void {
+	for (const persona of personas) {
+		const shell = (persona.selection?.tools ?? []).filter((tool) =>
+			(SHELL_TOOLS as readonly string[]).includes(tool),
+		);
+		if (shell.length > 0)
+			throw new ConfigError(
+				`webChat: persona "${persona.kind}" selects ${shell.join(", ")}, which agentServer: { tools: "chat-only" } withholds from every turn. Take the tool out of the persona's selection.`,
+			);
+	}
+}