pi-ui-extend 1.0.22 → 1.0.23

package/dist/app/rendering/conversation-entry-renderer.js

@@ -7,11 +7,14 @@ import { renderConversationShellEntry } from "./conversation-shell-renderer.js";
 import { renderConversationToolEntry, renderThinkingEntry } from "./conversation-tool-renderer.js";
 export function renderConversationEntry(entry, width, options) {
     const { left: userContentLeft, contentWidth: userContentWidth } = horizontalPaddingLayout(width);
-    const userLine = (text, entryId, syntaxHighlight, segments) => ({
+    const userLine = (text, entryId, syntaxHighlight, segments, links) => ({
         text: padHorizontalText(text, width),
         colorOverride: options.colors.userForeground,
         backgroundOverride: options.colors.userMessageBackground,
         ...(segments && segments.length > 0 ? { segments: segments.map((segment) => ({ ...segment, start: segment.start + userContentLeft, end: segment.end + userContentLeft })) } : {}),
+        ...(links && links.length > 0 ? {
+            links: links.map((link) => ({ ...link, start: link.start + userContentLeft, end: link.end + userContentLeft })),
+        } : {}),
         ...(syntaxHighlight === undefined ? {} : { syntaxHighlight }),
         ...(entryId === undefined ? {} : { target: { kind: "user-message", id: entryId } }),
     });
@@ -23,7 +26,10 @@ export function renderConversationEntry(entry, width, options) {
     });
     const userMessageLines = (userEntry) => {
         const lines = renderMarkdownTextLines(userEntry.text, userContentWidth, userContentLeft).map((line) => ({
-            ...userLine(line.text, userEntry.id, line.syntaxHighlight, line.segments),
+            ...userLine(line.text, userEntry.id, line.syntaxHighlight, [
+                ...(line.segments ?? []),
+                ...(line.links?.map((link) => ({ ...link, foreground: options.colors.info, underline: true })) ?? []),
+            ], line.links),
             ...(line.copyText === undefined ? {} : { copyText: line.copyText }),
             ...(line.continuesOnNextLine ? { continuesOnNextLine: true } : {}),
         }));
@@ -86,7 +92,9 @@ function renderAssistantLines(text, width, options) {
             ? { start: contentLeft, end: contentLeft + line.text.length, foreground: options.colors.assistantForeground, bold: true }
             : undefined;
         const existingSegments = line.segments?.map((segment) => ({ ...segment, start: segment.start + contentLeft, end: segment.end + contentLeft })) ?? [];
-        const allSegments = headingSegment ? [headingSegment, ...existingSegments] : existingSegments;
+        const links = line.links?.map((link) => ({ ...link, start: link.start + contentLeft, end: link.end + contentLeft })) ?? [];
+        const linkSegments = links.map((link) => ({ start: link.start, end: link.end, foreground: options.colors.info, underline: true }));
+        const allSegments = headingSegment ? [headingSegment, ...existingSegments, ...linkSegments] : [...existingSegments, ...linkSegments];
         lines.push({
             text: padHorizontalText(line.text, width),
             ...(line.copyText === undefined ? {} : { copyText: line.copyText }),
@@ -94,6 +102,7 @@ function renderAssistantLines(text, width, options) {
             colorOverride: options.colors.assistantForeground,
             backgroundOverride: options.colors.assistantMessageBackground,
             ...(allSegments.length > 0 ? { segments: allSegments } : {}),
+            ...(links.length > 0 ? { links } : {}),
             ...(line.syntaxHighlight ? { syntaxHighlight: line.syntaxHighlight } : {}),
         });
     }

package/dist/app/rendering/render-controller.js

@@ -57,6 +57,7 @@ export class AppRenderController {
         this.deps.mouseController.syncConversationSelectionForRender(scrollMetrics.start, bodyHeight, topReservedRows, conversationColumns);
         this.deps.mouseController.renderedTargets.clear();
         this.deps.mouseController.renderedRowTexts.clear();
+        this.deps.mouseController.renderedLinks.clear();
         this.deps.mouseController.renderedRowBackgrounds.clear();
         this.deps.mouseController.renderedImageTargets.clear();
         this.deps.mouseController.statusModelTarget = undefined;
@@ -109,6 +110,8 @@ export class AppRenderController {
                 this.deps.mouseController.renderedTargets.set(row, rendered.target);
             if (rendered?.imageTargets?.length)
                 this.deps.mouseController.renderedImageTargets.set(row, rendered.imageTargets);
+            if (rendered?.links?.length)
+                this.deps.mouseController.renderedLinks.set(row, rendered.links);
             this.deps.mouseController.renderedRowTexts.set(row, rendered?.text ?? "");
             setRenderedBackground(row, rendered?.backgroundOverride);
             appendFrameOutput(row, this.renderFrameRow(row, this.deps.screenStyler.styleBaseLine(row, rendered, conversationColumns)));
@@ -128,6 +131,8 @@ export class AppRenderController {
                 this.deps.mouseController.renderedTargets.set(row, rendered.line.target);
             if (rendered.line?.imageTargets?.length)
                 this.deps.mouseController.renderedImageTargets.set(row, rendered.line.imageTargets);
+            if (rendered.line?.links?.length)
+                this.deps.mouseController.renderedLinks.set(row, rendered.line.links);
             this.deps.mouseController.renderedRowTexts.set(row, rendered.text);
             setRenderedBackground(row, rendered.line?.backgroundOverride);
             appendFrameOutput(row, this.renderFrameRow(row, rendered.output(row)));
@@ -182,6 +187,8 @@ export class AppRenderController {
                 this.deps.mouseController.renderedTargets.set(row, rendered.line.target);
             if (rendered.line?.imageTargets?.length)
                 this.deps.mouseController.renderedImageTargets.set(row, rendered.line.imageTargets);
+            if (rendered.line?.links?.length)
+                this.deps.mouseController.renderedLinks.set(row, rendered.line.links);
             this.deps.mouseController.renderedRowTexts.set(row, rendered.text);
             setRenderedBackground(row, rendered.line?.backgroundOverride);
             appendFrameOutput(row, this.renderFrameRow(row, rendered.output(row)));

package/dist/app/screen/mouse-controller.d.ts

@@ -97,6 +97,7 @@ export declare class AppMouseController {
         id: string;
     } | import("../types.js").ToastLineTarget | undefined>;
     readonly renderedRowTexts: Map<number, string>;
+    readonly renderedLinks: Map<number, readonly RenderedLink[]>;
     readonly renderedRowBackgrounds: Map<number, string>;
     readonly renderedImageTargets: Map<number, readonly ImageClickTarget[]>;
     statusModelTarget: StatusModelTarget | undefined;

package/dist/app/screen/mouse-controller.js

@@ -18,6 +18,7 @@ export class AppMouseController {
     commandController;
     renderedTargets = new Map();
     renderedRowTexts = new Map();
+    renderedLinks = new Map();
     renderedRowBackgrounds = new Map();
     renderedImageTargets = new Map();
     statusModelTarget;
@@ -308,7 +309,7 @@ export class AppMouseController {
         const text = this.renderedRowTexts.get(event.y);
         if (!text)
             return undefined;
-        for (const link of detectFileLinks(text, this.host.cwd())) {
+        for (const link of [...(this.renderedLinks.get(event.y) ?? []), ...detectFileLinks(text, this.host.cwd())]) {
             const startColumn = stringDisplayWidth(text.slice(0, link.start)) + 1;
             const endColumn = startColumn + stringDisplayWidth(text.slice(link.start, link.end));
             if (event.x >= startColumn && event.x < endColumn)

package/dist/markdown-format.d.ts

@@ -8,10 +8,16 @@ export type RenderedMarkdownLine = {
         end: number;
         bold: true;
     }[];
+    links?: readonly RenderedMarkdownLink[];
     heading?: boolean;
     sourceStart?: number;
     sourceEnd?: number;
 };
+export type RenderedMarkdownLink = {
+    start: number;
+    end: number;
+    url: string;
+};
 export type RenderedMarkdownTextLine = {
     text: string;
     copyText?: string;
@@ -21,6 +27,7 @@ export type RenderedMarkdownTextLine = {
         end: number;
         bold: true;
     }[] | undefined;
+    links?: readonly RenderedMarkdownLink[] | undefined;
     syntaxHighlight?: SyntaxLineHighlight | undefined;
     heading?: boolean;
 };

package/dist/markdown-format.js

@@ -44,6 +44,7 @@ export function formatMarkdownTables(text, maxWidth) {
 export function renderMarkdownLine(text, start = 0) {
     const safeStart = Math.max(0, Math.min(text.length, start));
     const segments = [];
+    const links = [];
     let rendered = text.slice(0, safeStart);
     let index = safeStart;
     let inCode = false;
@@ -66,10 +67,20 @@ export function renderMarkdownLine(text, start = 0) {
                 continue;
             }
         }
+        if (!inCode && char === "[" && text[index - 1] !== "!" && !isEscaped(text, index)) {
+            const link = markdownLinkAt(text, index);
+            if (link) {
+                const linkStart = rendered.length;
+                rendered += link.label;
+                links.push({ start: linkStart, end: rendered.length, url: link.url });
+                index = link.end;
+                continue;
+            }
+        }
         rendered += char;
         index += 1;
     }
-    return { text: rendered, segments, ...(isHeading ? { heading: true } : {}) };
+    return { text: rendered, segments, ...(links.length > 0 ? { links } : {}), ...(isHeading ? { heading: true } : {}) };
 }
 export function renderMarkdownTextLines(text, width, start = 0, options = {}) {
     const lines = [];
@@ -84,7 +95,7 @@ export function renderMarkdownTextLines(text, width, start = 0, options = {}) {
         const syntaxHighlight = markdownLineSyntaxHighlight(fence, Boolean(opensFence || closesFence), start);
         const isHeadingLine = !fence && /^\s{0,3}#{1,6}\s/.test(rawLine);
         const markdownLine = syntaxHighlight?.language === "markdown" || isHeadingLine ? renderMarkdownLine(rawLine) : undefined;
-        const logicalLine = markdownLine ?? { text: rawLine, segments: [] };
+        const logicalLine = markdownLine ?? { text: rawLine, segments: [], links: [] };
         for (const wrapped of wrapRenderedMarkdownLine(logicalLine, width, options)) {
             const wrappedSyntaxHighlight = syntaxHighlight && wrapped.sourceStart !== undefined && wrapped.sourceEnd !== undefined
                 ? {
@@ -103,6 +114,7 @@ export function renderMarkdownTextLines(text, width, start = 0, options = {}) {
                 ...(wrapped.copyText === undefined ? {} : { copyText: wrapped.copyText }),
                 ...(wrapped.continuesOnNextLine ? { continuesOnNextLine: true } : {}),
                 ...(wrapped.segments.length > 0 ? { segments: wrapped.segments } : {}),
+                ...(wrapped.links && wrapped.links.length > 0 ? { links: wrapped.links } : {}),
                 ...(wrappedSyntaxHighlight ? { syntaxHighlight: wrappedSyntaxHighlight } : {}),
                 ...(isHeadingLine ? { heading: true } : {}),
             });
@@ -141,11 +153,15 @@ function wrapRenderedMarkdownLine(line, width, options) {
     if (stringDisplayWidth(line.text) <= safeWidth)
         return [line];
     const ranges = wrapDisplayLineByWordsWithRanges(line.text, safeWidth, options);
+    const links = line.links ?? [];
     return ranges.map((range, index) => ({
         text: range.text,
         copyText: line.text.slice(range.start, ranges[index + 1]?.start ?? range.end),
         ...(index < ranges.length - 1 ? { continuesOnNextLine: true } : {}),
         segments: line.segments.flatMap((segment) => shiftSegmentToRange(segment, range.start, range.end)),
+        ...(links.length > 0
+            ? { links: links.flatMap((link) => shiftLinkToRange(link, range.start, range.end)) }
+            : {}),
         sourceStart: range.start,
         sourceEnd: range.end,
     }));
@@ -320,6 +336,47 @@ function shiftSegmentToRange(segment, rangeStart, rangeEnd) {
         return [];
     return [{ ...segment, start: start - rangeStart, end: end - rangeStart }];
 }
+function shiftLinkToRange(link, rangeStart, rangeEnd) {
+    const start = Math.max(link.start, rangeStart);
+    const end = Math.min(link.end, rangeEnd);
+    if (end <= start)
+        return [];
+    return [{ ...link, start: start - rangeStart, end: end - rangeStart }];
+}
+function markdownLinkAt(text, start) {
+    const labelEnd = findUnescapedCharacter(text, "]", start + 1);
+    if (labelEnd <= start + 1 || text[labelEnd + 1] !== "(")
+        return undefined;
+    const destinationStart = labelEnd + 2;
+    let nestedParentheses = 0;
+    for (let index = destinationStart; index < text.length; index += 1) {
+        if (isEscaped(text, index))
+            continue;
+        const char = text[index] ?? "";
+        if (char === "(") {
+            nestedParentheses += 1;
+            continue;
+        }
+        if (char !== ")")
+            continue;
+        if (nestedParentheses > 0) {
+            nestedParentheses -= 1;
+            continue;
+        }
+        const url = text.slice(destinationStart, index);
+        if (!/^(?:file|https?):\/\/\S+$/u.test(url))
+            return undefined;
+        return { label: text.slice(start + 1, labelEnd), url, end: index + 1 };
+    }
+    return undefined;
+}
+function findUnescapedCharacter(text, character, start) {
+    for (let index = start; index < text.length; index += 1) {
+        if (text[index] === character && !isEscaped(text, index))
+            return index;
+    }
+    return -1;
+}
 function parseMarkdownTableBlock(lines, start) {
     const header = parseMarkdownTableRow(lines[start] ?? "");
     if (!header)

package/external/pi-tools-suite/README.md

@@ -257,13 +257,18 @@ to its trusted runner, so browser QA does not depend on a separately installed
 skill or CLI. The private workflow remains mandatory when configuration appends
 other isolated skills; parent and ordinary sub-agent sessions do not discover it.
 
-Keep named dev/staging auth profiles in project `.pi/qa_auth.jsonc` (there is no
-`/qa-auth` command). The private runner supports `form`, `cookie`, `localStorage`,
+Public browser QA does not require an auth profile or `.pi/qa_auth.jsonc`: run it
+with an explicit base URL, whose exact origin becomes the fail-closed allowlist.
+The runner neither creates nor requests a credential file for that path.
+
+For targets that actually require login, keep named dev/staging auth profiles in
+project `.pi/qa_auth.jsonc` (there is no `/qa-auth` command). The private runner
+supports `form`, `cookie`, `localStorage`,
 `sessionStorage`, `bearer`, and existing Playwright `storageState` auth. Every
-profile must declare exact `allowedOrigins`; select the profile id explicitly when
-spawning QA. On POSIX, keep the config at mode `0600`. During a run those origins
-also form the fail-closed HTTP(S)/WebSocket allowlist and service workers are
-blocked. Example:
+profile must declare exact `allowedOrigins`; select the profile id explicitly only
+for authenticated QA. On POSIX, keep the config at mode `0600`. During a run
+those origins also form the fail-closed HTTP(S)/WebSocket allowlist and service
+workers are blocked. Example:
 
 ```jsonc
 {
@@ -302,7 +307,9 @@ The runner validates the owning agent metadata and refuses flows outside that
 workspace; reusing an agent id clears stale browser QA files first. Trace archives
 have network records and non-image resources removed, then known
 configured/runtime credential values are redacted and verified before retention.
-Missing, ambiguous, rejected, or expired auth returns `QA_PROFILE_REQUIRED` or
+Listing profiles when the auth file is absent returns an empty list without
+creating a template. Only an explicit authenticated request may create the
+private template. Missing, rejected, or expired selected auth returns
 `QA_AUTH_UPDATE_REQUIRED`, naming only the profile/file/reason needed for the
 parent to ask the user for an update and rerun. See
 `src/async-subagents/private-skills/browser-qa/references/qa-auth.example.jsonc`

package/external/pi-tools-suite/docs/browser-qa-subagent.md

@@ -4,8 +4,8 @@
 
 Provide a cheap, fast `browser-qa` async-subagent that reproduces browser bugs
 and proves fixes with deterministic assertions plus screenshot, video, and trace
-evidence. The role uses `antigravity/gemini-3-flash-preview`, falling back to
-`openai-codex/gpt-5.4-mini`.
+evidence. The role uses `openai-codex/gpt-5.4-mini`, falling back to
+`antigravity/gemini-3-flash-preview` and then `zai/glm-5.3`.
 
 ## Private skill isolation
 
@@ -26,11 +26,16 @@ evidence. The role uses `antigravity/gemini-3-flash-preview`, falling back to
 
 ## Authentication contract
 
+- Public browser QA requires no auth profile and does not create or require
+  `.pi/qa_auth.jsonc`. Its explicit base URL supplies the one exact allowed
+  origin, and the runner still blocks every other HTTP(S)/WebSocket origin.
 - Auth profiles live in project-local `.pi/qa_auth.jsonc` and are selected by
   explicit id. The file must be a real project-local file with mode `0600` on
   POSIX. Profile listings expose only `id`, description, and traits.
-- When authenticated QA first needs credentials and that file is absent, the
-  runner creates a private empty template and returns `provide_credentials`.
+- Listing profiles when the file is absent returns an empty list without side
+  effects. When authenticated QA explicitly requests credentials and that file
+  is absent, the runner creates a private empty template and returns
+  `provide_credentials`.
   The sub-agent must explicitly ask the user to fill the reported file and
   rerun QA; it must not read or edit the credential values itself.
 - Every profile requires one or more exact `allowedOrigins`. Secret-bearing auth
@@ -46,8 +51,8 @@ evidence. The role uses `antigravity/gemini-3-flash-preview`, falling back to
   `.pi/subagents/<run>/<agent-id>/browser-qa/` workspace. Multiple profiles use
   separate browser contexts/evidence directories, and normal sub-agent shutdown
   or cleanup removes the whole workspace with its run.
-- Missing, ambiguous, rejected, or expired auth returns a machine-readable
-  update-required/profile-required status naming only the profile id, config
+- Missing, rejected, or expired explicitly selected auth returns a
+  machine-readable update-required status naming only the profile id, config
   file, and redacted reason. The parent asks the user to update the file and
   reruns; there is no `/qa-auth` command.
 
@@ -83,10 +88,10 @@ evidence. The role uses `antigravity/gemini-3-flash-preview`, falling back to
    profile; ordinary profiles retain existing skill discovery behavior.
 3. Auth profile listing and all error output are redacted; model-authored input
    cannot execute code in the credential-bearing process.
-4. Runner tests cover explicit profile selection, all auth modes, fail-closed
-   origins, path/mode hardening, private empty-template creation, explicit
-   credential requests, non-executable flows, and successful redacted evidence
-   creation.
+4. Runner tests cover public execution without an auth file, explicit profile
+   selection, all auth modes, fail-closed origins, path/mode hardening, private
+   empty-template creation only on an explicit auth request, non-executable
+   flows, and successful redacted evidence creation.
 5. Browser QA flows/evidence live only inside the owning sub-agent directory;
    deleting the run removes them while persistent auth config/state remains.
 6. Completed test runs report clickable screenshot, video, and trace links

package/external/pi-tools-suite/src/async-subagents/private-skills/browser-qa/SKILL.md

@@ -23,14 +23,19 @@ Never read, print, grep, copy, or edit credential values from
 3. Discover the requested target, expected behavior, and the smallest scenario
    that can prove it. If the target cannot be reached or started, report the
    concrete blocker instead of substituting static checks for browser QA.
-4. Run `node <runner> profiles`. Choose a profile only when the task names its
-   id or safe profile traits make the choice unambiguous. Otherwise stop with
-   `QA_PROFILE_REQUIRED` and list only ids, descriptions, and traits.
+4. If the requested behavior requires authentication, run
+   `node <runner> profiles`. A missing auth config is valid and returns an empty
+   list without creating `.pi/qa_auth.jsonc`. Otherwise skip profile discovery
+   and use public mode. Choose an auth profile only when the task names its id,
+   safe profile traits make the choice unambiguous, or a public run proves that
+   the requested page requires login.
 5. Inspect the target code and write a declarative JSONC flow under
    `$PI_SUBAGENT_AGENT_DIR/browser-qa/flows/`. Never put credentials or
    executable JavaScript in it.
-6. Run:
-   `node <runner> run --profile <id> --base-url <url> --flow <flow.jsonc>`.
+6. Run public QA with
+   `node <runner> run --base-url <url> --flow <flow.jsonc>`. The URL's exact
+   origin becomes the fail-closed allowlist. Only for authenticated QA, add
+   `--profile <id>`; the selected profile then owns the URL and allowlist.
    Profile id, URL, and flow path are non-secret; never pass credentials as
    arguments or environment variables.
 7. Report deterministic assertions and every artifact returned by the runner.
@@ -108,12 +113,19 @@ after login succeeds so credentials are not captured in the trace.
 
 ## Credentials and blocked runs
 
-If the runner returns `QA_AUTH_UPDATE_REQUIRED`, stop and explicitly report that
-browser QA requires credentials or an auth-config update. Ask the user to fill
-the reported file and rerun QA. If `templateCreated` is true, say that a private
-empty template was created at that path. Relay only the runner's profile, file,
-reason, action, and template-created state; never read the generated file or
-attempt to recover by exposing or replaying credentials.
+Do not request credentials merely because `.pi/qa_auth.jsonc` is absent. If the
+task explicitly requires authenticated behavior, or a public run reaches the
+flow's `authRejectedIf` check, and `profiles` returned no usable profile, run
+`node <runner> profiles --require-auth`. Only this explicit authenticated path
+may create the private empty template.
+
+If that command or an authenticated run returns `QA_AUTH_UPDATE_REQUIRED`, stop
+and explicitly report that authenticated browser QA requires credentials or an
+auth-config update. Ask the user to fill the reported file and rerun QA. If
+`templateCreated` is true, say that a private empty template was created at that
+path. Relay only the runner's profile, file, reason, action, and template-created
+state; never read the generated file or attempt to recover by exposing or
+replaying credentials.
 
 For any other blocked run, report the runner status and redacted reason. Do not
 claim that browser QA passed based on source inspection, unit tests, or a build.

package/external/pi-tools-suite/src/async-subagents/private-skills/browser-qa/scripts/browser-qa-runner.mjs

@@ -13,7 +13,6 @@ const QA_WORKSPACE_RELATIVE = "browser-qa";
 const EVIDENCE_RELATIVE = "evidence";
 const FORM_VIDEO_STEP_DELAY_MS = 250;
 const EXIT_AUTH_UPDATE_REQUIRED = 42;
-const EXIT_PROFILE_REQUIRED = 43;
 const PROFILE_ID = /^[A-Za-z0-9._-]+$/;
 const AUTH_TEMPLATE = `{
   // Authenticated browser QA requires at least one project-local profile.
@@ -58,7 +57,7 @@ main().catch((error) => {
 	writeStatus({
 		status: statusError.status,
 		profile: statusError.profileId,
-		file: CONFIG_RELATIVE,
+		...(statusError.status === "QA_AUTH_UPDATE_REQUIRED" ? { file: CONFIG_RELATIVE } : {}),
 		reason: statusError.reason,
 		...statusError.details,
 	});
@@ -68,15 +67,21 @@ main().catch((error) => {
 async function main() {
 	const [command = "profiles", ...rawArgs] = process.argv.slice(2);
 	const cwd = fs.realpathSync(process.cwd());
-	const config = readAuthConfig(cwd);
 	if (command === "profiles") {
-		writeStatus({ status: "QA_PROFILES", profiles: safeProfiles(config.profiles) });
+		const requireAuth = rawArgs.length === 1 && rawArgs[0] === "--require-auth";
+		if (rawArgs.length > 0 && !requireAuth) {
+			throw new QaStatusError("QA_RUN_FAILED", `invalid profiles argument: ${rawArgs[0]}`, 1);
+		}
+		const config = readAuthConfig(cwd, requireAuth);
+		writeStatus({ status: "QA_PROFILES", authConfigPresent: config.present, profiles: safeProfiles(config.profiles) });
 		return;
 	}
 	if (command !== "run") throw new QaStatusError("QA_RUN_FAILED", `unknown command: ${command}`, 1);
 
 	const args = parseArgs(rawArgs);
-	const selected = selectProfile(config.profiles, args.profile);
+	const selected = args.profile
+		? selectProfile(readAuthConfig(cwd, true).profiles, args.profile)
+		: createPublicProfile(args.baseUrl);
 	const profileId = selected.id;
 	const profile = selected.profile;
 	const secrets = collectSecrets(profile.auth);
@@ -192,9 +197,10 @@ async function runQa({ cwd, agentDir, args, profileId, profile }) {
 	writeStatus({ status: "QA_PASSED", profile: profileId, ...evidenceDetails });
 }
 
-function readAuthConfig(cwd) {
+function readAuthConfig(cwd, required = false) {
 	const candidate = path.join(cwd, CONFIG_RELATIVE);
 	if (!fs.existsSync(candidate)) {
+		if (!required) return { present: false, profiles: {} };
 		let templateCreated;
 		try {
 			templateCreated = createAuthTemplate(cwd);
@@ -222,7 +228,10 @@ function readAuthConfig(cwd) {
 	if (errors.length > 0) {
 		throw new QaStatusError("QA_AUTH_UPDATE_REQUIRED", `auth config is invalid JSONC (${printParseErrorCode(errors[0].error)})`, EXIT_AUTH_UPDATE_REQUIRED);
 	}
-	if (!isObject(value) || !isObject(value.profiles) || Object.keys(value.profiles).length === 0) {
+	if (!isObject(value) || !isObject(value.profiles)) {
+		throw new QaStatusError("QA_AUTH_UPDATE_REQUIRED", "auth config must define a profiles object", EXIT_AUTH_UPDATE_REQUIRED);
+	}
+	if (required && Object.keys(value.profiles).length === 0) {
 		throw new QaStatusError(
 			"QA_AUTH_UPDATE_REQUIRED",
 			"credentials are required; auth config must define a non-empty profiles object",
@@ -234,7 +243,7 @@ function readAuthConfig(cwd) {
 	if (Object.keys(value.profiles).some((id) => !isSafeName(id))) {
 		throw new QaStatusError("QA_AUTH_UPDATE_REQUIRED", "auth profile ids may contain only letters, digits, dot, underscore, or dash", EXIT_AUTH_UPDATE_REQUIRED);
 	}
-	return value;
+	return { ...value, present: true };
 }
 
 function safeProfiles(profiles) {
@@ -248,15 +257,6 @@ function safeProfiles(profiles) {
 }
 
 function selectProfile(profiles, requestedId) {
-	if (!requestedId) {
-		throw new QaStatusError(
-			"QA_PROFILE_REQUIRED",
-			"select one auth profile by id",
-			EXIT_PROFILE_REQUIRED,
-			undefined,
-			{ profiles: safeProfiles(profiles) },
-		);
-	}
 	if (!isSafeName(requestedId) || !isObject(profiles[requestedId])) {
 		throw new QaStatusError("QA_AUTH_UPDATE_REQUIRED", "requested auth profile is missing or invalid", EXIT_AUTH_UPDATE_REQUIRED, requestedId);
 	}
@@ -267,6 +267,26 @@ function selectProfile(profiles, requestedId) {
 	return { id: requestedId, profile };
 }
 
+function createPublicProfile(rawBaseUrl) {
+	if (typeof rawBaseUrl !== "string") {
+		throw new QaStatusError("QA_RUN_FAILED", "--base-url is required when running without --profile", 1, "public");
+	}
+	try {
+		const url = new URL(rawBaseUrl);
+		if (!/^https?:$/.test(url.protocol) || url.username || url.password) throw new Error();
+		return {
+			id: "public",
+			profile: {
+				baseUrl: url.href,
+				allowedOrigins: [url.origin],
+				auth: { type: "none" },
+			},
+		};
+	} catch {
+		throw new QaStatusError("QA_RUN_FAILED", "public --base-url must be an http(s) URL without embedded credentials", 1, "public");
+	}
+}
+
 function normalizeAllowedOrigins(value, profileId) {
 	if (!Array.isArray(value) || value.length === 0) {
 		throw new QaStatusError("QA_AUTH_UPDATE_REQUIRED", "profile must define allowedOrigins", EXIT_AUTH_UPDATE_REQUIRED, profileId);
@@ -296,6 +316,8 @@ function normalizeBaseUrl(raw, allowedOrigins, profileId) {
 
 function validateAuthConfiguration(cwd, auth, allowedOrigins, profileId) {
 	switch (auth.type) {
+		case "none":
+			break;
 		case "cookie":
 			if (!Array.isArray(auth.cookies) || auth.cookies.length === 0) throw authError(profileId, "cookie auth requires cookies");
 			for (const cookie of auth.cookies) {
@@ -467,6 +489,7 @@ function isStringArray(value) {
 
 async function contextOptionsForAuth({ cwd, profileId, profile, allowedOrigins }) {
 	const auth = profile.auth;
+	if (auth.type === "none") return {};
 	if (auth.type === "storageState") {
 		if (typeof auth.path !== "string") throw authError(profileId, "storageState path is missing");
 		const statePath = resolveExistingPrivateFile(cwd, auth.path, "storageState");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-ui-extend",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "description": "Pix: a workspace-first terminal UI for Pi with tabs, readable tool activity, voice input, and bundled agent tools.",
   "private": false,
   "repository": {