pi-webdesk 0.1.0

package/dist/apps/daemon/src/pi-auth.js

@@ -0,0 +1,290 @@
+// apps/daemon/src/pi-auth.ts
+import { randomUUID } from "node:crypto";
+import {
+  PROTOCOL_VERSION,
+  piAuthNoticeSchema,
+  piAuthOperationSchema,
+  piAuthPromptSchema,
+  piAuthSnapshotSchema
+} from "../../../packages/protocol/src/index.js";
+var PiAuthOperationError = class extends Error {
+  name = "PiAuthOperationError";
+  code;
+  status;
+  constructor(code, message, status, options) {
+    super(message, options);
+    this.code = code;
+    this.status = status;
+  }
+};
+var TERMINAL_STATES = /* @__PURE__ */ new Set([
+  "succeeded",
+  "failed",
+  "cancelled"
+]);
+var MAX_RETAINED_OPERATIONS = 20;
+function abortError(message = "Pi provider login was cancelled.") {
+  const error = new Error(message);
+  error.name = "AbortError";
+  return error;
+}
+function mapPrompt(id, prompt) {
+  switch (prompt.type) {
+    case "select":
+      return piAuthPromptSchema.parse({
+        id,
+        type: "select",
+        message: prompt.message,
+        options: prompt.options.map((option) => ({ ...option }))
+      });
+    case "text":
+    case "secret":
+    case "manual_code":
+      return piAuthPromptSchema.parse({
+        id,
+        type: prompt.type,
+        message: prompt.message,
+        ...prompt.placeholder === void 0 ? {} : { placeholder: prompt.placeholder }
+      });
+  }
+}
+function mapNotice(notice) {
+  switch (notice.type) {
+    case "info":
+      return piAuthNoticeSchema.parse({
+        type: "info",
+        message: notice.message,
+        ...notice.links === void 0 ? {} : { links: notice.links.map((link) => ({ ...link })) }
+      });
+    case "auth_url":
+      return piAuthNoticeSchema.parse({
+        type: "auth_url",
+        url: notice.url,
+        ...notice.instructions === void 0 ? {} : { instructions: notice.instructions }
+      });
+    case "device_code":
+      return piAuthNoticeSchema.parse({
+        type: "device_code",
+        userCode: notice.userCode,
+        verificationUri: notice.verificationUri,
+        ...notice.intervalSeconds === void 0 ? {} : { intervalSeconds: notice.intervalSeconds },
+        ...notice.expiresInSeconds === void 0 ? {} : { expiresInSeconds: notice.expiresInSeconds }
+      });
+    case "progress":
+      return piAuthNoticeSchema.parse({
+        type: "progress",
+        message: notice.message
+      });
+  }
+}
+function createPiAuthCoordinator(options) {
+  const now = options.now ?? Date.now;
+  const operations = /* @__PURE__ */ new Map();
+  let disposed = false;
+  function requireActive() {
+    if (disposed) {
+      throw new PiAuthOperationError(
+        "auth-unavailable",
+        "The Pi authentication service is shutting down.",
+        503
+      );
+    }
+  }
+  function result(entry) {
+    return piAuthOperationSchema.parse({
+      protocol: PROTOCOL_VERSION,
+      type: "pi-auth-operation",
+      id: entry.id,
+      providerId: entry.providerId,
+      method: entry.method,
+      state: entry.state,
+      prompt: entry.prompt,
+      notice: entry.notice,
+      ...entry.error === null ? {} : { error: entry.error }
+    });
+  }
+  function requireOperation(operationId) {
+    requireActive();
+    const entry = operations.get(operationId);
+    if (entry === void 0) {
+      throw new PiAuthOperationError(
+        "operation-not-found",
+        "That Pi login operation no longer exists.",
+        404
+      );
+    }
+    return entry;
+  }
+  function trimOperations() {
+    if (operations.size <= MAX_RETAINED_OPERATIONS) return;
+    const terminal = [...operations.values()].filter((entry) => TERMINAL_STATES.has(entry.state)).sort((left, right) => left.createdAt - right.createdAt);
+    while (operations.size > MAX_RETAINED_OPERATIONS && terminal.length > 0) {
+      const oldest = terminal.shift();
+      if (oldest !== void 0) operations.delete(oldest.id);
+    }
+  }
+  function prompt(entry, request) {
+    if (entry.controller.signal.aborted) return Promise.reject(abortError());
+    if (entry.pending !== null) {
+      return Promise.reject(
+        new Error("Pi requested two authentication prompts at the same time.")
+      );
+    }
+    const promptId = randomUUID();
+    entry.prompt = mapPrompt(promptId, request);
+    entry.state = "waiting";
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        if (entry.pending?.id !== promptId) return;
+        entry.pending = null;
+        entry.prompt = null;
+        reject(abortError());
+      };
+      const signals = [entry.controller.signal, request.signal].filter(
+        (signal) => signal !== void 0
+      );
+      for (const signal of signals) signal.addEventListener("abort", onAbort, { once: true });
+      entry.pending = {
+        id: promptId,
+        resolve,
+        reject,
+        removeAbortListener() {
+          for (const signal of signals) signal.removeEventListener("abort", onAbort);
+        }
+      };
+      if (signals.some((signal) => signal.aborted)) onAbort();
+    });
+  }
+  function runLogin(entry) {
+    const interaction = {
+      signal: entry.controller.signal,
+      prompt: (request) => prompt(entry, request),
+      notify(notice) {
+        entry.notice = mapNotice(notice);
+      }
+    };
+    void options.auth.login(entry.providerId, entry.method, interaction).then(
+      () => {
+        if (entry.state === "cancelled") return;
+        entry.pending?.removeAbortListener();
+        entry.pending = null;
+        entry.prompt = null;
+        entry.error = null;
+        entry.state = "succeeded";
+        trimOperations();
+      },
+      (error) => {
+        entry.pending?.removeAbortListener();
+        entry.pending = null;
+        entry.prompt = null;
+        if (entry.state === "cancelled" || entry.controller.signal.aborted) {
+          entry.state = "cancelled";
+          entry.error = null;
+        } else {
+          entry.state = "failed";
+          entry.error = "Pi provider login failed. Try again or check the provider configuration.";
+        }
+        trimOperations();
+      }
+    );
+  }
+  return {
+    async snapshot() {
+      requireActive();
+      try {
+        const providers = await options.auth.listProviders();
+        const active = [...operations.values()].find(
+          (entry) => !TERMINAL_STATES.has(entry.state)
+        );
+        return piAuthSnapshotSchema.parse({
+          protocol: PROTOCOL_VERSION,
+          type: "pi-auth-snapshot",
+          providers,
+          activeOperation: active === void 0 ? null : result(active)
+        });
+      } catch (error) {
+        throw new PiAuthOperationError(
+          "auth-unavailable",
+          "Pi provider status is unavailable.",
+          503,
+          { cause: error }
+        );
+      }
+    },
+    isAuthenticated(providerId) {
+      requireActive();
+      return options.auth.hasAuth(providerId);
+    },
+    startLogin(providerId, method) {
+      requireActive();
+      const active = [...operations.values()].find(
+        (entry2) => !TERMINAL_STATES.has(entry2.state)
+      );
+      if (active !== void 0) {
+        throw new PiAuthOperationError(
+          "operation-conflict",
+          `Finish or cancel the existing ${active.providerId} login first.`,
+          409
+        );
+      }
+      const entry = {
+        id: randomUUID(),
+        providerId,
+        method,
+        state: "running",
+        prompt: null,
+        notice: null,
+        error: null,
+        controller: new AbortController(),
+        pending: null,
+        createdAt: now()
+      };
+      operations.set(entry.id, entry);
+      runLogin(entry);
+      return result(entry);
+    },
+    operation(operationId) {
+      return result(requireOperation(operationId));
+    },
+    respond(operationId, promptId, value) {
+      const entry = requireOperation(operationId);
+      if (entry.state !== "waiting" || entry.pending?.id !== promptId) {
+        throw new PiAuthOperationError(
+          "operation-conflict",
+          "That Pi login prompt is no longer waiting for a response.",
+          409
+        );
+      }
+      const pending = entry.pending;
+      pending.removeAbortListener();
+      entry.pending = null;
+      entry.prompt = null;
+      entry.state = "running";
+      pending.resolve(value);
+      return result(entry);
+    },
+    cancel(operationId) {
+      const entry = requireOperation(operationId);
+      if (TERMINAL_STATES.has(entry.state)) return result(entry);
+      entry.state = "cancelled";
+      entry.prompt = null;
+      entry.error = null;
+      entry.controller.abort();
+      return result(entry);
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      for (const entry of operations.values()) {
+        if (!TERMINAL_STATES.has(entry.state)) {
+          entry.state = "cancelled";
+          entry.controller.abort();
+        }
+      }
+    }
+  };
+}
+export {
+  PiAuthOperationError,
+  createPiAuthCoordinator
+};

package/dist/apps/daemon/src/pi-resources.js

@@ -0,0 +1,182 @@
+// apps/daemon/src/pi-resources.ts
+import {
+  PiBridgeError,
+  createPiConfigurationInspector,
+  sanitizeApprovalDisplayText
+} from "../../../packages/pi-bridge/src/index.js";
+import {
+  PI_CONFIGURATION_MAX_DIAGNOSTICS,
+  PI_CONFIGURATION_MAX_PACKAGES,
+  PI_CONFIGURATION_MAX_RESOURCES,
+  PROTOCOL_VERSION,
+  piConfigurationSnapshotSchema
+} from "../../../packages/protocol/src/index.js";
+var PiConfigurationOperationError = class extends Error {
+  name = "PiConfigurationOperationError";
+  code;
+  status;
+  constructor(code, message, status, options) {
+    super(message, options);
+    this.code = code;
+    this.status = status;
+  }
+};
+function display(text, maximum, fallback = "Unknown") {
+  const safe = sanitizeApprovalDisplayText(text.slice(0, maximum));
+  const bounded = safe.length <= maximum ? safe : safe.slice(0, maximum);
+  return bounded.trim() === "" ? fallback : bounded;
+}
+function redactCredentialText(text) {
+  return text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/giu, "$1[redacted]@").replace(
+    /([?&](?:access[_-]?token|api[_-]?key|auth|credential|password|secret|token)=)[^&#\s]*/giu,
+    "$1[redacted]"
+  ).replace(/\b(?:github_pat_|gh[pousr]_|sk-)[a-z0-9_-]{8,}\b/giu, "[redacted]");
+}
+function credentialSafeDisplay(text, maximum, fallback) {
+  return display(redactCredentialText(text), maximum, fallback);
+}
+function displayPath(text) {
+  return display(text, 4096, "(unavailable)");
+}
+function displayValue(value) {
+  return value === null ? null : display(value, 2e3, "Empty");
+}
+function mapInspection(taskId, canonicalWorktree, inspection) {
+  if (inspection.cwd !== canonicalWorktree) {
+    throw new PiConfigurationOperationError(
+      "inspection-failed",
+      "Pi configuration was returned for a different task directory.",
+      503
+    );
+  }
+  const packages = inspection.packages.slice(0, PI_CONFIGURATION_MAX_PACKAGES).map((entry) => ({
+    ...entry,
+    source: credentialSafeDisplay(entry.source, 1e3, "local package"),
+    installedPath: entry.installedPath === null ? null : displayPath(entry.installedPath)
+  }));
+  const resources = inspection.resources.slice(0, PI_CONFIGURATION_MAX_RESOURCES).map((entry) => ({
+    ...entry,
+    name: display(entry.name, 500, entry.kind),
+    description: entry.description === null ? null : credentialSafeDisplay(entry.description, 2e3, ""),
+    path: displayPath(entry.path),
+    source: credentialSafeDisplay(entry.source, 1e3, "local")
+  }));
+  const diagnostics = inspection.diagnostics.slice(0, PI_CONFIGURATION_MAX_DIAGNOSTICS).map((entry) => ({
+    ...entry,
+    message: credentialSafeDisplay(
+      entry.message,
+      2e3,
+      "Pi reported a resource problem."
+    ),
+    path: entry.path === null ? null : displayPath(entry.path)
+  }));
+  return piConfigurationSnapshotSchema.parse({
+    protocol: PROTOCOL_VERSION,
+    type: "pi-configuration-snapshot",
+    taskId,
+    piVersion: display(inspection.piVersion, 100),
+    cwd: displayPath(inspection.cwd),
+    agentDir: displayPath(inspection.agentDir),
+    settingsPaths: {
+      global: displayPath(inspection.settingsPaths.global),
+      project: displayPath(inspection.settingsPaths.project),
+      trust: displayPath(inspection.settingsPaths.trust)
+    },
+    trust: {
+      ...inspection.trust,
+      savedAtPath: inspection.trust.savedAtPath === null ? null : displayPath(inspection.trust.savedAtPath)
+    },
+    packages,
+    resources,
+    settings: inspection.settings.map((entry) => ({
+      ...entry,
+      key: display(entry.key, 200),
+      label: display(entry.label, 500),
+      globalValue: displayValue(entry.globalValue),
+      projectValue: displayValue(entry.projectValue),
+      effectiveValue: display(entry.effectiveValue, 2e3, "Not set")
+    })),
+    diagnostics,
+    omitted: {
+      packages: inspection.omitted.packages + Math.max(0, inspection.packages.length - PI_CONFIGURATION_MAX_PACKAGES),
+      resources: inspection.omitted.resources + Math.max(0, inspection.resources.length - PI_CONFIGURATION_MAX_RESOURCES),
+      diagnostics: inspection.omitted.diagnostics + Math.max(0, inspection.diagnostics.length - PI_CONFIGURATION_MAX_DIAGNOSTICS)
+    }
+  });
+}
+function createPiConfigurationService(options) {
+  const inspector = options.inspector ?? createPiConfigurationInspector();
+  const activeInspections = /* @__PURE__ */ new Map();
+  async function inspectTask(taskId) {
+    let task;
+    try {
+      task = await options.getTask(taskId);
+    } catch (error) {
+      throw new PiConfigurationOperationError(
+        "inspection-failed",
+        "The task could not be resolved from the local workspace.",
+        503,
+        { cause: error }
+      );
+    }
+    if (task === null) {
+      throw new PiConfigurationOperationError(
+        "task-not-found",
+        "The selected task no longer exists.",
+        404
+      );
+    }
+    if (task.status !== "ready") {
+      throw new PiConfigurationOperationError(
+        "task-not-ready",
+        `Only a ready task has an inspectable Pi configuration; this task is ${task.status}.`,
+        409
+      );
+    }
+    let canonicalWorktree;
+    try {
+      canonicalWorktree = await options.verifyTaskWorktree(taskId);
+    } catch (error) {
+      throw new PiConfigurationOperationError(
+        "task-not-ready",
+        "The task worktree could not be verified before reading Pi configuration.",
+        409,
+        { cause: error }
+      );
+    }
+    try {
+      return mapInspection(taskId, canonicalWorktree, await inspector.inspect(canonicalWorktree));
+    } catch (error) {
+      if (error instanceof PiConfigurationOperationError) throw error;
+      if (error instanceof PiBridgeError && error.code === "PI_REQUEST_TIMEOUT") {
+        throw new PiConfigurationOperationError(
+          "inspection-timeout",
+          "Pi configuration inspection took too long. Check unusually large resource directories and retry.",
+          504,
+          { cause: error }
+        );
+      }
+      throw new PiConfigurationOperationError(
+        "inspection-failed",
+        "Pi configuration could not be inspected. Check the daemon output for details.",
+        503,
+        { cause: error }
+      );
+    }
+  }
+  return {
+    inspect(taskId) {
+      const existing = activeInspections.get(taskId);
+      if (existing !== void 0) return existing;
+      const operation = inspectTask(taskId).finally(() => {
+        if (activeInspections.get(taskId) === operation) activeInspections.delete(taskId);
+      });
+      activeInspections.set(taskId, operation);
+      return operation;
+    }
+  };
+}
+export {
+  PiConfigurationOperationError,
+  createPiConfigurationService
+};

package/dist/apps/daemon/src/pi-runtime-factory.js

@@ -0,0 +1,19 @@
+// apps/daemon/src/pi-runtime-factory.ts
+import { createPiRpcRuntime, resolvePiInvocation } from "../../../packages/pi-bridge/src/index.js";
+function createPiTaskRuntimeFactory(options = {}) {
+  return ({ worktreePath, sessionFile }) => {
+    const invocation = resolvePiInvocation();
+    return createPiRpcRuntime({
+      executable: invocation.executable,
+      prependArgs: invocation.prependArgs,
+      cwd: worktreePath,
+      mode: "supervised",
+      sessionMode: "persistent",
+      ...options.supervisorIgnoreEofForTests === true ? { supervisorIgnoreEofForTests: true } : {},
+      ...sessionFile === null ? {} : { sessionFile }
+    });
+  };
+}
+export {
+  createPiTaskRuntimeFactory
+};