pi-webapp 0.1.21 → 0.1.22

package/docs/desktop.md

@@ -20,7 +20,13 @@ npm run desktop:start
 nodejs.org, verifies the archive against the official HTTPS SHA-256 manifest,
 and installs the pinned production dependencies from
 `desktop/runtime-manifest/package-lock.json`. It verifies the bundled Pi version
-and actually starts a PTY before declaring success. Internet is required while
+and actually starts an interactive PTY, answers terminal queries, and checks its
+output and clean exit before declaring success. Linux compiles only the pinned
+`node-pty` lifecycle with the bundled Node and archive headers (the package has
+no Linux prebuild); Windows stages its pinned ConPTY DLL/helper payload. No
+Electron-ABI addon or host build is reused. Linux builders need Python and a C++
+toolchain; end users do not need these to run the packaged PTY.
+Internet is required while
 building, not to install Node/Pi on the end user's machine. Model calls,
 authorization and package installation can still require internet.
 
@@ -50,7 +56,9 @@ e.g. `pi-0.1.20-desktop.5-mac-arm64.dmg`. “pi → 关于 pi” shows the build
 and executable location, so different desktop rebuilds are distinguishable even
 when their shared backend stays at the same npm version. `desktop/release.json`
 is the single source for the desktop name/build; increment its build number for
-each delivered rebuild. The CFBundleVersion / Windows file version also changes.
+each delivered rebuild. The CFBundleVersion / Windows file version also changes. AppImage filenames use
+electron-builder's Linux deployment spelling `x86_64`; the runner/runtime
+architecture and release target ID remain `x64` / `linux-x64`.
 
 Cross-platform/architecture flags are
 intentionally rejected by the wrapper: using the current machine's Node/native
@@ -59,6 +67,12 @@ native runners for each target. `desktop.yml` remains a manual cross-platform
 packaging/artifact workflow. The separate `desktop-release.yml` below handles
 verified macOS arm64 prereleases, not every main push.
 
+The embedded runtime never automatically launches a second browser for its Web
+page: the shared browser opener honors `PI_WEBAPP_AUTO_OPEN=0` and desktop runtime
+identity. In particular, startup does not await a long-lived `xdg-open` browser
+before announcing backend readiness. The explicit native “在浏览器中打开” menu and
+confirmed connection-recovery actions remain available.
+
 The application embeds Node and Pi. Git, SSH, project compilers and other system
 tools are **not** bundled. Missing tools must be installed by the user. Model
 accounts/API credentials must still be configured in the existing settings UI.
@@ -133,24 +147,38 @@ its independent npm pipeline may write another version. Increment the desktop
 build number for each delivered rebuild. Tag creation/release is an intentional
 publication action, not part of an ordinary main commit.
 
-The build job uses standard `macos-15` arm64, pinned npm lockfiles, standalone
-Node/Pi preparation, icon/config tests and the **packaged** desktop/browser/PTY
-smoke. Sentry reporting and signing discovery are disabled. It produces:
-
-- `pi-<version>-desktop.<build>-mac-arm64.dmg`
-- `SHA256SUMS` (DMG SHA-256)
-- `desktop-release.json` (source SHA, backend/build/runtime versions, unsigned
-  status, platform/architecture, file size/checksum and smoke checks)
-- `release-notes.md` (used as the Release body, not a separate download asset)
-
-A separate Ubuntu job has scoped `contents: write` and no npm installation/app
-execution. It revalidates the source-bound files, creates a **draft prerelease**,
-uploads only the three intended assets, downloads them to verify their bytes,
-and only then publishes the prerelease with `latest=false`. Signing is not
-claimed. An interrupted upload leaves a draft; retrying the same source/tag may
-repair a draft. A published release is never clobbered: a retry only succeeds
-when downloaded assets are byte-identical. A conflicting source/tag or different
-published bytes fails rather than replacing a public download.
+The candidate build-6 pipeline adds four **native** targets:
+
+| Target | Runner | Installer payload tested |
+| --- | --- | --- |
+| macOS arm64 | macos-15 | Read-only mounted DMG / pi.app |
+| macOS x64 | macos-15-intel | Read-only mounted DMG / pi.app |
+| Windows x64 | windows-2022 | NSIS silently installed pi.exe on disposable CI runner |
+| Linux x64 | ubuntu-22.04 | Extracted AppImage AppRun under Xvfb, without requiring FUSE |
+
+Each uses locked dependencies, standalone Node/Pi, full unit tests and actual
+installer-payload desktop/browser/PTY smoke. The smoke reads the installed Pi
+package and requires the same pinned version. Signing discovery and Sentry are
+disabled. ARM Windows/Linux and other targets are not implicitly supported.
+
+A read-only aggregation job requires **all four** verified receipts from the
+same source/version/build/Pi pair. It collects four installers, SHA256SUMS,
+`desktop-release.json` (schema 2, per-target runtime and smoke evidence), and
+release-notes.md. A missing/failed target prevents the complete release; matrix
+entries alone are not an acceptance claim. Build-only runs also exercise this
+aggregation, but never create a public Release.
+
+Only the final Ubuntu publish job gets `contents: write`, with no npm installation
+or app execution. It checks the bundle, creates a **draft prerelease**, uploads
+four installers plus checksums and metadata, downloads all six assets to verify
+their bytes, then publishes with `latest=false`. An interrupted upload stays a
+draft; retries may repair it. Published assets are never clobbered: a retry only
+succeeds if every downloaded file is byte-identical. Conflicting source/tag or
+bytes fail rather than replacing a public download.
+
+The original public build 5 remains macOS-arm64-only with Pi 0.87.1. Do not
+advertise candidate target support or point users to candidate installer links
+until native jobs pass and that new build has actually been published.
 
 The packing wrapper deliberately retains `--publish never`: explicit CI Release
 upload owns publication. The manual cross-platform package workflow remains
@@ -237,7 +265,21 @@ without global Node/Pi. It tests renderer isolation, real PTY interaction,
 authentication, file listing, desktop update protection, a browser connected to
 the same service, and confirmed shutdown/process cleanup. It does **not** submit
 a paid model request, log in to a provider, or use the user's saved credentials.
-Screenshots/results are written to `artifacts/desktop/`.
+Screenshots/results are written to `artifacts/desktop/`. CI also persists a
+secret-free phase receipt before each major step, bounds installer smoke to six
+minutes, and bounds cleanup of its exact isolated Electron child. Failures retain
+only bounded, redacted tails of that fixture's launcher log and Electron stderr,
+plus allowlisted launcher metadata (never the URL, nonce, auth files or user
+sessions). Locale is seeded before navigation; the first UI must become usable
+before a real reload is tested, avoiding interruption of initial bootstrap.
+The locale seed touches only the actual HTTP loopback root, not opaque/error
+pages; real loopback storage errors still fail the test. Smoke opts into
+`PI_WEBAPP_STARTUP_TRACE=1`: the launcher records fixed RPC startup milestones,
+never RPC payloads, command bodies, URLs or access/control tokens. POSIX SDK and
+shell/Git integration tests run on macOS/Linux. Windows runs portable SDK/launcher
+boundaries, desktop/release invariants, an interactive native cmd PTY test, and
+the actual installed-payload GUI smoke; Unix executable fixtures are not treated
+as Windows tests. All four installer receipts remain mandatory for assembly.
 
 The legacy smoke uses a temporary HOME/agent directory and copies the old package
 without changing its launcher or extension JavaScript. It prepares node-pty's
@@ -255,16 +297,17 @@ configuration to make a fixture pass.
 
 ## Why the bundled Pi may not be the latest upstream version
 
-The desktop bundles **Pi 0.87.1** because that is the host project's explicitly
-pinned and tested SDK/runtime pair, not because npm automatically chose its
-latest release. `package.json` and `desktop/runtime-manifest/package-lock.json`
+The build-6 candidate pins **Pi 1.3.0**, the upstream latest checked on
+2026-10-20. The previously published build 5 bundles **Pi 0.87.1**. A source
+upgrade does not mutate that old download or a running external Web service. `package.json` and `desktop/runtime-manifest/package-lock.json`
 pin both `@earendil-works/pi-coding-agent` and `@earendil-works/pi-ai` together.
 The standalone Node runtime and native PTY are verified as part of that unit.
 The app version, desktop build number and bundled Pi version are separate.
 
 The public npm `latest` for both Pi packages was **1.3.0 when checked on
-2026-10-20**. Thus 0.87.1 is **not** the latest Pi; a validated pin should not be
-misrepresented as one or become an excuse never to maintain the dependency.
+2026-10-20**. Thus the older build's 0.87.1 is **not** the latest Pi. The candidate upgrade
+has passed typechecks and existing tests; native package gates still decide
+whether it may be offered as a new public download.
 Moving from the tested 0.x SDK to 1.x needs API/type compatibility review, paired
 lockfile updates, authentication/plugin/session regressions, native PTY checks,
 and packaged desktop/Web smoke tests before publishing a new installer.

package/docs/sentry.md

@@ -108,7 +108,7 @@ node scripts/publish-verified-release.mjs
 
 `verify:sentry` first checks credentials and the package, then invokes the packaged Node verification entry and serves the packaged browser assets on loopback with synthetic configuration. It sends only synthetic events to the configured Sentry DSNs with `environment=sentry-verification`; normal imports and normal browser environments do not run these probes. The Node entry requires `PI_WEB_SENTRY_VERIFY_RELEASE=true` and the verification environment; the browser requires a verification-configured server and the explicit `sentry_release_probe=1` URL flag. The CLI sets up these guards itself.
 
-The verifier waits at most 120 seconds for the real events, checks release/build/side/Debug IDs, and requires original application frames to resolve to TypeScript. The synthetic exception must resolve to the exact source file and line recorded in the archived map. Browser maps give application sources stable `app:///web/src/` and `app:///shared/` paths before upload. Unmapped external SDK dependencies do not invalidate resolved application frames. A successful run writes `.ci/release/verified.json` with event IDs and the tarball SHA-256. The publisher verifies that receipt and hash before publishing that tarball with lifecycle scripts disabled. Missing credentials, failed uploads, mismatched package assets, unmapped application frames, missing receipts, or changed tarballs block publication. Version synchronization to main occurs only after these checks succeed.
+The verifier waits at most 120 seconds for the real events, checks release/build/side/Debug IDs, and requires original application frames to resolve to TypeScript. The synthetic exception must resolve to the exact source file and line recorded in the archived map. Browser maps give application sources stable `app:///src/` and `app:///web/src/` paths before upload. Unmapped external SDK dependencies do not invalidate resolved application frames. A successful run writes `.ci/release/verified.json` with event IDs and the tarball SHA-256. The publisher verifies that receipt and hash before publishing that tarball with lifecycle scripts disabled. Missing credentials, failed uploads, mismatched package assets, unmapped application frames, missing receipts, or changed tarballs block publication. Version synchronization to main occurs only after these checks succeed.
 
 For mapping failures, use Sentry's event source-map debugger or its `source-map-debug` API, and inspect matching Debug IDs for application bundles. Old tool-result events without original stacks remain limited even after source maps are uploaded.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-webapp",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "type": "module",
   "description": "A browser interface for Pi with live chat, workspaces, models, and attachments",
   "repository": {
@@ -15,7 +15,7 @@
     "pi-webapp": "./bin/pi-webapp.mjs"
   },
   "pi": {
-    "image": "https://cdn.jsdelivr.net/npm/pi-webapp@0.1.21/assets/cover-webapp.png",
+    "image": "https://cdn.jsdelivr.net/npm/pi-webapp@0.1.22/assets/cover-webapp.png",
     "extensions": [
       "./dist/extension.js"
     ]
@@ -39,7 +39,7 @@
     "status": "node bin/pi-webapp.mjs status",
     "stop": "node bin/pi-webapp.mjs stop",
     "check": "tsc --noEmit && tsc -p web/tsconfig.json",
-    "test": "node --import ./test/setup-env.mjs --experimental-strip-types --test test/*.test.ts && npm run test:desktop",
+    "test": "node --import ./test/setup-env.mjs --experimental-strip-types --test --test-concurrency=4 test/*.test.ts && npm run test:desktop",
     "test:desktop": "node --test desktop/test/*.test.mjs",
     "desktop:icons": "node scripts/generate-desktop-icons.mjs",
     "desktop:sync-runtime": "node scripts/sync-desktop-runtime.mjs",
@@ -69,8 +69,8 @@
   },
   "devDependencies": {
     "@chengzhiyi/pi-web-protocol": "0.1.0",
-    "@earendil-works/pi-ai": "0.87.1",
-    "@earendil-works/pi-coding-agent": "0.87.1",
+    "@earendil-works/pi-ai": "1.3.0",
+    "@earendil-works/pi-coding-agent": "1.3.0",
     "@playwright/test": "1.63.0",
     "@sentry/esbuild-plugin": "5.4.0",
     "@sentry/vite-plugin": "5.4.0",

package/web/dist/.vite/manifest.json

@@ -81,7 +81,7 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/elixir.mjs": {
-    "file": "assets/elixir-DI-tUE_U.js",
+    "file": "assets/elixir-R3IvWmT5.js",
     "name": "elixir",
     "src": "../../node_modules/@shikijs/langs/dist/elixir.mjs",
     "isDynamicEntry": true,
@@ -122,13 +122,13 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/graphql.mjs": {
-    "file": "assets/graphql-Bz9lYT3E.js",
+    "file": "assets/graphql-DSgZM88T.js",
     "name": "graphql",
     "src": "../../node_modules/@shikijs/langs/dist/graphql.mjs",
     "isDynamicEntry": true,
     "imports": [
       "_javascript-D_ijBMSX.js",
-      "_app-4px1DWHV.js",
+      "_app-D54rSb9U.js",
       "index.html"
     ]
   },
@@ -151,7 +151,7 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/html.mjs": {
-    "file": "assets/html-DfmEJESS.js",
+    "file": "assets/html-COcRjUs1.js",
     "name": "html",
     "src": "../../node_modules/@shikijs/langs/dist/html.mjs",
     "isDynamicEntry": true,
@@ -161,12 +161,12 @@
     ]
   },
   "../../node_modules/@shikijs/langs/dist/http.mjs": {
-    "file": "assets/http-oJQxPuUz.js",
+    "file": "assets/http-BnatDCTa.js",
     "name": "http",
     "src": "../../node_modules/@shikijs/langs/dist/http.mjs",
     "isDynamicEntry": true,
     "imports": [
-      "_app-4px1DWHV.js",
+      "_app-D54rSb9U.js",
       "../../node_modules/@shikijs/langs/dist/xml.mjs",
       "../../node_modules/@shikijs/langs/dist/graphql.mjs",
       "index.html",
@@ -187,7 +187,7 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/julia.mjs": {
-    "file": "assets/julia-VEDmabGN.js",
+    "file": "assets/julia-yApUWuwQ.js",
     "name": "julia",
     "src": "../../node_modules/@shikijs/langs/dist/julia.mjs",
     "isDynamicEntry": true,
@@ -261,7 +261,7 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/perl.mjs": {
-    "file": "assets/perl-g_tPwekP.js",
+    "file": "assets/perl-CpGQZpC_.js",
     "name": "perl",
     "src": "../../node_modules/@shikijs/langs/dist/perl.mjs",
     "isDynamicEntry": true,
@@ -275,7 +275,7 @@
     ]
   },
   "../../node_modules/@shikijs/langs/dist/php.mjs": {
-    "file": "assets/php-C_eP8QT0.js",
+    "file": "assets/php-C7wdcWqa.js",
     "name": "php",
     "src": "../../node_modules/@shikijs/langs/dist/php.mjs",
     "isDynamicEntry": true,
@@ -284,7 +284,7 @@
       "../../node_modules/@shikijs/langs/dist/xml.mjs",
       "../../node_modules/@shikijs/langs/dist/sql.mjs",
       "_javascript-D_ijBMSX.js",
-      "_app-4px1DWHV.js",
+      "_app-D54rSb9U.js",
       "../../node_modules/@shikijs/langs/dist/css.mjs",
       "../../node_modules/@shikijs/langs/dist/java.mjs",
       "index.html"
@@ -315,16 +315,16 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/rst.mjs": {
-    "file": "assets/rst-D71MTZLw.js",
+    "file": "assets/rst-DXm1XNUD.js",
     "name": "rst",
     "src": "../../node_modules/@shikijs/langs/dist/rst.mjs",
     "isDynamicEntry": true,
     "imports": [
-      "_html-derivative-BaRuZAr6.js",
+      "_html-derivative-C2Epw9Yg.js",
       "../../node_modules/@shikijs/langs/dist/cpp.mjs",
       "../../node_modules/@shikijs/langs/dist/python.mjs",
       "_javascript-D_ijBMSX.js",
-      "_app-4px1DWHV.js",
+      "_app-D54rSb9U.js",
       "../../node_modules/@shikijs/langs/dist/yaml.mjs",
       "../../node_modules/@shikijs/langs/dist/cmake.mjs",
       "../../node_modules/@shikijs/langs/dist/ruby.mjs",
@@ -340,7 +340,7 @@
     ]
   },
   "../../node_modules/@shikijs/langs/dist/ruby.mjs": {
-    "file": "assets/ruby-DVYYFOy_.js",
+    "file": "assets/ruby-BM86KL0M.js",
     "name": "ruby",
     "src": "../../node_modules/@shikijs/langs/dist/ruby.mjs",
     "isDynamicEntry": true,
@@ -353,7 +353,7 @@
       "../../node_modules/@shikijs/langs/dist/graphql.mjs",
       "../../node_modules/@shikijs/langs/dist/cpp.mjs",
       "../../node_modules/@shikijs/langs/dist/c.mjs",
-      "_app-4px1DWHV.js",
+      "_app-D54rSb9U.js",
       "../../node_modules/@shikijs/langs/dist/lua.mjs",
       "../../node_modules/@shikijs/langs/dist/yaml.mjs",
       "../../node_modules/@shikijs/langs/dist/java.mjs",
@@ -388,13 +388,13 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/svelte.mjs": {
-    "file": "assets/svelte-uHeUtAW3.js",
+    "file": "assets/svelte-Dizghd7i.js",
     "name": "svelte",
     "src": "../../node_modules/@shikijs/langs/dist/svelte.mjs",
     "isDynamicEntry": true,
     "imports": [
       "_javascript-D_ijBMSX.js",
-      "_app-4px1DWHV.js",
+      "_app-D54rSb9U.js",
       "../../node_modules/@shikijs/langs/dist/css.mjs",
       "index.html"
     ]
@@ -430,16 +430,16 @@
     "isDynamicEntry": true
   },
   "../../node_modules/@shikijs/langs/dist/vue.mjs": {
-    "file": "assets/vue-C1Yqc5Ux.js",
+    "file": "assets/vue-DJuuwuj_.js",
     "name": "vue",
     "src": "../../node_modules/@shikijs/langs/dist/vue.mjs",
     "isDynamicEntry": true,
     "imports": [
       "../../node_modules/@shikijs/langs/dist/css.mjs",
       "_javascript-D_ijBMSX.js",
-      "_app-4px1DWHV.js",
+      "_app-D54rSb9U.js",
       "../../node_modules/@shikijs/langs/dist/html.mjs",
-      "_html-derivative-BaRuZAr6.js",
+      "_html-derivative-C2Epw9Yg.js",
       "index.html"
     ]
   },
@@ -694,18 +694,47 @@
     "file": "assets/KaTeX_Typewriter-Regular.woff2",
     "src": "../../node_modules/katex/dist/fonts/KaTeX_Typewriter-Regular.woff2"
   },
-  "WorkspaceTerminal.tsx": {
-    "file": "assets/WorkspaceTerminal-DF87HK0D.js",
-    "name": "WorkspaceTerminal",
-    "src": "WorkspaceTerminal.tsx",
+  "../../src/host/client/telemetry-client.ts": {
+    "file": "assets/telemetry-client-CBQBug9X.js",
+    "name": "telemetry-client",
+    "src": "../../src/host/client/telemetry-client.ts",
+    "isDynamicEntry": true,
+    "imports": [
+      "index.html"
+    ]
+  },
+  "../../src/plugins/builtin/files/client/plugin.tsx": {
+    "file": "assets/plugin-DuICpslz.js",
+    "name": "plugin",
+    "src": "../../src/plugins/builtin/files/client/plugin.tsx",
+    "isDynamicEntry": true,
+    "imports": [
+      "_app-D54rSb9U.js",
+      "index.html"
+    ]
+  },
+  "../../src/plugins/builtin/git/client/plugin.tsx": {
+    "file": "assets/plugin-U9RqGH7R.js",
+    "name": "plugin",
+    "src": "../../src/plugins/builtin/git/client/plugin.tsx",
     "isDynamicEntry": true,
     "imports": [
-      "_app-4px1DWHV.js",
+      "_app-D54rSb9U.js",
       "index.html"
     ]
   },
-  "_app-4px1DWHV.js": {
-    "file": "assets/app-4px1DWHV.js",
+  "../../src/plugins/builtin/terminal/client/plugin.tsx": {
+    "file": "assets/plugin-CDXXKG8W.js",
+    "name": "plugin",
+    "src": "../../src/plugins/builtin/terminal/client/plugin.tsx",
+    "isDynamicEntry": true,
+    "imports": [
+      "_app-D54rSb9U.js",
+      "index.html"
+    ]
+  },
+  "_app-D54rSb9U.js": {
+    "file": "assets/app-D54rSb9U.js",
     "name": "app",
     "isDynamicEntry": true,
     "imports": [
@@ -769,7 +798,9 @@
       "../../node_modules/@shikijs/langs/dist/make.mjs",
       "../../node_modules/@shikijs/langs/dist/cmake.mjs",
       "../../node_modules/@shikijs/langs/dist/groovy.mjs",
-      "WorkspaceTerminal.tsx"
+      "../../src/plugins/builtin/files/client/plugin.tsx",
+      "../../src/plugins/builtin/terminal/client/plugin.tsx",
+      "../../src/plugins/builtin/git/client/plugin.tsx"
     ],
     "assets": [
       "assets/KaTeX_AMS-Regular.woff2",
@@ -833,8 +864,8 @@
       "assets/KaTeX_Typewriter-Regular.ttf"
     ]
   },
-  "_html-derivative-BaRuZAr6.js": {
-    "file": "assets/html-derivative-BaRuZAr6.js",
+  "_html-derivative-C2Epw9Yg.js": {
+    "file": "assets/html-derivative-C2Epw9Yg.js",
     "name": "html-derivative",
     "imports": [
       "../../node_modules/@shikijs/langs/dist/html.mjs"
@@ -850,21 +881,12 @@
     "src": "index.html",
     "isEntry": true,
     "dynamicImports": [
-      "telemetry-client.ts",
-      "_app-4px1DWHV.js"
+      "../../src/host/client/telemetry-client.ts",
+      "_app-D54rSb9U.js"
     ]
   },
   "style.css": {
     "file": "assets/style.css",
     "src": "style.css"
-  },
-  "telemetry-client.ts": {
-    "file": "assets/telemetry-client-CBQBug9X.js",
-    "name": "telemetry-client",
-    "src": "telemetry-client.ts",
-    "isDynamicEntry": true,
-    "imports": [
-      "index.html"
-    ]
   }
 }