pi-roundtable-webchat 0.9.8 → 0.9.10

package/CHANGELOG.md

@@ -5,6 +5,18 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.9.10] - 2026-10-10
+
+### Added
+
+- A turn run for a message carries the `Origin` header its connection's upgrade was accepted with, as `origin` on `context.turns.run`, so a tool reads it as `ToolTurn.origin`. It is trimmed and lower-cased and kept only when it is a serialized `scheme://host[:port]` of at most 256 characters; a connection that sent none, or an `Origin` of another shape, leaves it undefined. It is read from the transport at the upgrade, never from a frame or the message text. Needs pi-roundtable 0.9.10 or later to reach tools; on an older core the extra field is ignored.
+
+## [0.9.9] - 2026-10-10
+
+### Added
+
+- A privacy note in the README for the core's `attachments.retention`: a host can have the files messages used removed after a period, which also gives the person's `usedAttachmentBytesPerPrincipal` allowance back. The plugin needs no setting of its own for it. `memoryAttachments` (the test double) implements the port's new optional `expireUsed`.
+
 ## [0.9.8] - 2026-10-10
 
 - Release in lockstep with pi-roundtable 0.9.8; no package-specific behavior changes.

package/README.md

@@ -169,6 +169,9 @@ The token is never read from a URL.
 - **Another client**, such as a service, sends `Authorization: Bearer <token>` on the upgrade and offers `roundtable.webchat.v1`.
 
 The server echoes `roundtable.webchat.v1`.
+The `Origin` an accepted upgrade carried is kept on the connection, trimmed and lower-cased, and each message's turn passes it to the core as `origin`, so a tool reads it as `turn.origin` (for example to write where an issue was filed from).
+It is read from the transport only, never from a frame or the message text.
+A client that sent none, which only a route with `origins: "any"` admits, or a header that is not a serialized `scheme://host[:port]`, leaves `turn.origin` undefined; a tool that needs it should fail closed then.
 An upgrade from an origin not in `origins`, or without one, is refused with 403; without a valid ticket or token with 401; for a person the core policy does not admit with 403; past the person's connection limit with 429.
 
 ```js
@@ -297,6 +300,12 @@ An upload no message used is deleted after `unsentUploadTtlMs` (24 hours): the p
 Files a message used stay with their conversation, in the host's data directory, as long as the conversation does: when the conversation is deleted, the core removes them, the uploads waiting for it, and their share of the person's allowance.
 This plugin has no way to delete a conversation itself; a host surface that deletes one does it through the core.
 
+**Privacy: removing used files after a period.** A host that must not keep uploads sets the core's `attachments.retention` (`{ maxAgeMs, sweepEveryMs? }` in the host configuration; see the core's [plugin guide](https://github.com/wayne930242/pi-roundtable/blob/master/docs/plugins.md)), for example `{ maxAgeMs: 7 * 24 * 60 * 60_000 }` to keep no upload longer than seven days after the message that used it.
+The host then deletes the files and their records, and takes their bytes off the person's `usedAttachmentBytesPerPrincipal` allowance, so a person who sends files for months is not refused with `attachment_quota` for good.
+A model or tool that asks for a removed file is told it was removed after its retention period.
+The transcript is a separate record: this removes the files, not the messages that named them or what the model said about them. Uploads that no message used are deleted after `unsentUploadTtlMs` as before, whatever the retention.
+This needs a pi-roundtable release that has `attachments.retention`; on an earlier core the plugin keeps working and files simply live as long as their conversation.
+
 Uploads are as private as the transcript: files sit in the host's data directory under the private conversation, where the owner and the operator can read them, as they can the transcript.
 Only the person who uploaded a file can use it, and only in the conversation it was uploaded to; a shared conversation (one recorded for no one in particular) takes no uploads.
 
@@ -343,7 +352,7 @@ Only the person who uploaded a file can use it, and only in the conversation it
 | `attachmentsPerMessage` | 8 files named by one message |
 | `uploadsPerHour` | 60 uploads per person in any hour |
 | `unsentUploadBytesPerPrincipal` | 64 MiB per person uploaded and not yet used by a message; uploads arriving together are counted per web chat plugin instance, so two web chats on one host each hold a person to it separately |
-| `usedAttachmentBytesPerPrincipal` | 1 GiB per person kept by their messages across all conversations until a conversation is deleted; needs pi-roundtable 0.9.3 to be enforced |
+| `usedAttachmentBytesPerPrincipal` | 1 GiB per person kept by their messages across all conversations until a conversation is deleted or the host's `attachments.retention` removes the files; needs pi-roundtable 0.9.3 to be enforced |
 | `attachmentTypes` | `image/png`, `image/jpeg`, `image/webp`, `image/gif`, `application/json`, `text/plain`, `application/pdf` |
 | `unsentUploadTtlMs` | 24 hours before an unused upload is deleted |
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-webchat",
-	"version": "0.9.8",
+	"version": "0.9.10",
 	"description": "A WebSocket chat adapter for pi-roundtable: private web conversations for people an OpenID Connect provider signs in, with live progress and approval cards",
 	"type": "module",
 	"license": "MIT",
@@ -43,7 +43,7 @@
 		"@earendil-works/pi-ai": ">=1.0.0 <2",
 		"@earendil-works/pi-coding-agent": ">=1.0.0 <2",
 		"@types/bun": "1.4.2",
-		"pi-roundtable": "0.9.8",
+		"pi-roundtable": "0.9.10",
 		"typebox": "1.3.34",
 		"typescript": "7.0.2"
 	}

package/src/chat.ts

@@ -112,6 +112,8 @@ interface Minted {
 
 interface Pending {
 	speaker: Speaker;
+	/** The origin of the connection the message arrived on. */
+	origin?: string;
 	persona: WebPersona;
 	title: string;
 	/** The files the message references, moved into the conversation when it was accepted. */
@@ -600,6 +602,7 @@ export class WebChat {
 		const messageId = crypto.randomUUID();
 		this.#pending.set(messageId, {
 			speaker,
+			...(connection.origin ? { origin: connection.origin } : {}),
 			persona,
 			title: minted?.title ?? titleOf(text),
 			fresh: record === undefined,
@@ -805,6 +808,7 @@ export class WebChat {
 				kind: persona.kind,
 				text,
 				speaker,
+				...(pending.origin ? { origin: pending.origin } : {}),
 				interactive: true,
 				...(pending.attachments ? { attachments: pending.attachments } : {}),
 				...(persona.selection

package/src/connections.ts

@@ -6,6 +6,12 @@ import type { ServerFrame } from "./protocol.ts";
 export interface Connection {
 	identity: WebIdentity;
 	speaker: Speaker;
+	/**
+	 * The normalized `Origin` the upgrade carried and the route accepted; undefined when it sent none
+	 * (a client that is not a browser, on a route that admits `"any"` origin). Fixed for the
+	 * connection's life: it comes from the transport, never from a frame.
+	 */
+	origin?: string;
 	socket?: RouteSocket<Connection>;
 	/** Asks for a fresh token, then closes the socket when the token expires. */
 	timers: ReturnType<typeof setTimeout>[];

package/src/origin.ts

@@ -0,0 +1,17 @@
+/** The longest origin kept; a longer header is not a browser's. */
+const MAX_ORIGIN_LENGTH = 256;
+
+/** A serialized origin: a scheme, `://`, and a host with an optional port, with no path, query or space. */
+const ORIGIN = /^[a-z][a-z0-9+.-]*:\/\/[^\s/?#@]+$/;
+
+/**
+ * The connection's `Origin` header as a tool may label a record with it: trimmed and lower-cased,
+ * or undefined when the header is absent, the opaque `null`, over-long, or not a serialized origin.
+ * Browsers always send one; a client that is not a browser sends any text it likes, so the shape
+ * is checked here and nothing else is trusted about it.
+ */
+export function normalizeOrigin(header: string | null): string | undefined {
+	const value = header?.trim().toLowerCase();
+	if (!value || value.length > MAX_ORIGIN_LENGTH) return undefined;
+	return ORIGIN.test(value) ? value : undefined;
+}

package/src/plugin.ts

@@ -21,6 +21,7 @@ import type { Connection } from "./connections.ts";
 import { webDirectChannel } from "./direct-channel.ts";
 import { PgNotices } from "./notices.ts";
 import { TokenRefused, type TokenVerifier } from "./oidc.ts";
+import { normalizeOrigin } from "./origin.ts";
 import { TICKET_PROTOCOL_PREFIX, WEBCHAT_PROTOCOL } from "./protocol.ts";
 import { restHandler } from "./rest.ts";
 import { TicketBook } from "./tickets.ts";
@@ -240,7 +241,12 @@ export function webChat(options: WebChatOptions): RoundtablePlugin {
 					if (error instanceof Refusal) return refuse(403, "Forbidden");
 					throw error;
 				}
-				const connection: Connection = { ...admitted, timers: [] };
+				const origin = normalizeOrigin(request.headers.get("origin"));
+				const connection: Connection = {
+					...admitted,
+					...(origin ? { origin } : {}),
+					timers: [],
+				};
 				if (!chat.connections.reserve(connection))
 					return refuse(429, "Too Many Connections");
 				return {