pi2dsh 0.23.0 → 0.24.0

package/dist/{runtime-Dnk9mhrc.mjs → runtime-BiHMcD_8.mjs}

@@ -1165,102 +1165,6 @@ var BrowserSurfaces = class {
 	imageToolNames() {
 		return [...this.#imageToolNames];
 	}
-	#scene;
-	#sceneRevision = 0;
-	#sceneWidth = 100;
-	openScene(packageName, factory, theme, keybindings, options) {
-		this.#finishScene(void 0);
-		return new Promise((resolve, reject) => {
-			const run = {
-				package: packageName,
-				component: void 0,
-				options,
-				resolve,
-				reject
-			};
-			this.#scene = run;
-			const driver = { requestRender: () => this.#invalidateScene() };
-			const done = (value) => {
-				if (this.#scene !== run) return;
-				this.#finishScene(value);
-			};
-			Promise.resolve().then(() => factory(driver, theme, keybindings, done)).then((component) => {
-				if (this.#scene !== run) {
-					component.dispose?.();
-					return;
-				}
-				if (typeof component?.render !== "function") {
-					this.#scene = void 0;
-					this.#invalidateScene();
-					console.warn(`[pi2dsh] web scene for ${packageName}: component lacks render(width)`);
-					reject(/* @__PURE__ */ new TypeError("Pi custom component must implement render(width)"));
-					return;
-				}
-				run.component = component;
-				this.#invalidateScene();
-			}, (error) => {
-				if (this.#scene !== run) return;
-				this.#scene = void 0;
-				this.#invalidateScene();
-				console.warn(`[pi2dsh] web scene for ${packageName}: component factory failed: ${error instanceof Error ? error.stack ?? error.message : String(error)}`);
-				reject(error);
-			});
-		});
-	}
-	/** What the browser paints: the live component's frame, or a closed marker. */
-	sceneSnapshot() {
-		const scene = this.#scene;
-		if (scene?.component === void 0) return {
-			open: false,
-			revision: this.#sceneRevision
-		};
-		const requested = (typeof scene.options?.overlayOptions === "function" ? scene.options.overlayOptions() : scene.options?.overlayOptions)?.width;
-		const width = typeof requested === "number" && Number.isFinite(requested) && requested > 0 ? Math.min(this.#sceneWidth, Math.floor(requested)) : this.#sceneWidth;
-		let lines;
-		try {
-			lines = scene.component.render(width);
-		} catch (error) {
-			const failed = this.#scene;
-			this.#scene = void 0;
-			this.#invalidateScene();
-			console.warn(`[pi2dsh] web scene for ${scene.package}: render(width) failed: ${error instanceof Error ? error.stack ?? error.message : String(error)}`);
-			failed?.reject(error);
-			return {
-				open: false,
-				revision: this.#sceneRevision
-			};
-		}
-		return {
-			open: true,
-			package: scene.package,
-			revision: this.#sceneRevision,
-			lines
-		};
-	}
-	/** Raw terminal input from the browser keyboard, verbatim into the component. */
-	sceneInput(sequence, width) {
-		if (typeof width === "number" && Number.isFinite(width)) this.#sceneWidth = Math.max(20, Math.min(400, Math.floor(width)));
-		const component = this.#scene?.component;
-		if (component === void 0 || sequence.length === 0) return;
-		component.handleInput?.(sequence);
-		component.invalidate?.();
-		this.#invalidateScene();
-	}
-	/** The browser dismissed the overlay: resolve the Pi caller with undefined. */
-	closeScene() {
-		this.#finishScene(void 0);
-	}
-	#finishScene(value) {
-		const scene = this.#scene;
-		if (scene === void 0) return;
-		this.#scene = void 0;
-		scene.component?.dispose?.();
-		this.#invalidateScene();
-		scene.resolve(value);
-	}
-	#invalidateScene() {
-		this.#sceneRevision += 1;
-	}
 	/**
 	* Track one child session under its parent.
 	* @param parentSessionId - the session the panel floats over.
@@ -1300,9 +1204,20 @@ var BrowserSurfaces = class {
 			if (live.size === 0) this.#commandRunners.delete(sessionId);
 		};
 	}
-	/** The registered runner for (session, package), when one is mounted. */
+	/**
+	* The registered runner for (session, package), when one is mounted.
+	*
+	* An empty sessionId means "any session where the package is mounted":
+	* session-free product UI (a Settings page) invoking a package command
+	* whose effect is global state — the handler itself is the package's own
+	* either way, and every mounted copy routes to the same package storage.
+	*/
 	commandRunner(sessionId, packageName) {
-		return this.#commandRunners.get(sessionId)?.get(packageName);
+		if (sessionId !== "") return this.#commandRunners.get(sessionId)?.get(packageName);
+		for (const runners of this.#commandRunners.values()) {
+			const runner = runners.get(packageName);
+			if (runner !== void 0) return runner;
+		}
 	}
 	/**
 	* The panel's view of one parent session.
@@ -1718,6 +1633,46 @@ function registerBrowserSurfaceRoute(ctx, registry, hooks) {
 				response.end(JSON.stringify(outcome ?? { ok: true }));
 				return;
 			}
+			if (url.pathname === "/pi2dsh/login-state" && (method === "GET" || method === "HEAD")) {
+				if (hooks?.loginState === void 0) {
+					response.writeHead(404);
+					response.end();
+					return;
+				}
+				const body = JSON.stringify(await hooks.loginState());
+				response.writeHead(200, {
+					"content-type": "application/json; charset=utf-8",
+					"cache-control": "no-store"
+				});
+				response.end(method === "HEAD" ? void 0 : body);
+				return;
+			}
+			if (url.pathname === "/pi2dsh/login-action" && method === "POST") {
+				if (hooks?.loginAction === void 0) {
+					response.writeHead(404);
+					response.end();
+					return;
+				}
+				const chunks = [];
+				const raw = await new Promise((settle) => {
+					const stream = req;
+					stream.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+					stream.on("end", () => settle(Buffer.concat(chunks).toString("utf8")));
+				});
+				let outcome;
+				try {
+					const payload = JSON.parse(raw || "{}");
+					if (typeof payload.action !== "string") throw new TypeError("login-action needs { action }");
+					outcome = await hooks.loginAction(payload.action, typeof payload.provider === "string" ? payload.provider : "", typeof payload.value === "string" ? payload.value : "");
+				} catch (error) {
+					response.writeHead(400, { "content-type": "application/json; charset=utf-8" });
+					response.end(JSON.stringify({ error: error instanceof Error ? error.message : String(error) }));
+					return;
+				}
+				response.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+				response.end(JSON.stringify(outcome ?? { ok: true }));
+				return;
+			}
 			if (url.pathname === "/pi2dsh/pi-command" && method === "POST") {
 				const chunks = [];
 				const raw = await new Promise((settle) => {
@@ -1746,22 +1701,6 @@ function registerBrowserSurfaceRoute(ctx, registry, hooks) {
 				}
 				return;
 			}
-			if (method === "POST" && (url.pathname === "/pi2dsh/scene-input" || url.pathname === "/pi2dsh/scene-close")) {
-				const chunks = [];
-				const body = await new Promise((settle) => {
-					const stream = req;
-					stream.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-					stream.on("end", () => settle(Buffer.concat(chunks).toString("utf8")));
-				});
-				if (url.pathname === "/pi2dsh/scene-close") registry.closeScene();
-				else try {
-					const payload = JSON.parse(body || "{}");
-					if (typeof payload.sequence === "string") registry.sceneInput(payload.sequence, typeof payload.width === "number" ? payload.width : void 0);
-				} catch {}
-				response.writeHead(204);
-				response.end();
-				return;
-			}
 			if (method !== "GET" && method !== "HEAD") {
 				response.writeHead(405);
 				response.end();
@@ -1807,13 +1746,11 @@ function registerBrowserSurfaceRoute(ctx, registry, hooks) {
 			const body = JSON.stringify(session === "" ? {
 				threads: [],
 				surfaces: [],
-				entries: [],
-				scene: registry.sceneSnapshot()
+				entries: []
 			} : {
 				threads: registry.snapshot(session),
 				surfaces: registry.surfaces(session),
 				entries: registry.entries(session),
-				scene: registry.sceneSnapshot(),
 				...registry.draftRequest(session) === void 0 ? {} : { draft: registry.draftRequest(session) }
 			});
 			response.writeHead(200, {
@@ -4358,8 +4295,6 @@ function contextFor(ctx, state, agent, signal, command = false, sessionOverride,
 			if (headlessUi) return void 0;
 			const surfaces = state.tuiSurfaces;
 			if (surfaces !== void 0) return surfaces.custom(factory, state.theme, getKeybindings(), options);
-			const browser = state.shared.browserSurfaces;
-			if (browser !== void 0 && state.shared.browserSurfacesRouted === true) return browser.openScene(state.packageName, factory, state.theme, getKeybindings(), options);
 		},
 		pasteToEditor(text) {
 			const surfaces = state.shared.browserSurfaces;
@@ -4556,8 +4491,7 @@ function contextFor(ctx, state, agent, signal, command = false, sessionOverride,
 		},
 		ui,
 		get mode() {
-			if (state.tuiSurfaces?.available === true) return "tui";
-			return state.shared.browserSurfaces !== void 0 && state.shared.browserSurfacesRouted === true ? "tui" : "rpc";
+			return state.tuiSurfaces?.available === true ? "tui" : "rpc";
 		},
 		get hasUI() {
 			return state.tuiSurfaces?.available === true || humanAnswererAvailable(userQuestions, agent, state.shared);
@@ -6053,6 +5987,37 @@ async function supersedeActiveLogin(state) {
 * @param config - the provider config, whose oauth block made it loginable.
 * @returns whether this call put a route in place.
 */
+/**
+* Mount-time route restore that tolerates composition order.
+*
+* The credentials service (credentials-local) can compose AFTER a
+* zero-package profile's host mount — probing immediately loses that race and
+* a stored login silently produces no route: an engine-only profile with a
+* valid auth.json hit MISSING_CREDENTIAL on every turn, while installing any
+* Pi package shifted mount timing enough to mask the bug (2026-08-30,
+* community/full-audit-work/zero-package-oauth-bug.md). When the service is
+* already there the restore stays awaited — that is mount readiness, see the
+* caller's comment. Otherwise the official inject seam re-runs it the moment
+* the service composes, the same pattern maybeProjectAuthorizationFlow uses.
+*/
+async function restoreLoggedInRouteWhenReady(ctx, state, name, config) {
+	if (optionalService(ctx, "credentials") !== void 0) {
+		await ensureLoggedInProviderRoute(ctx, state, name, config);
+		return;
+	}
+	const shared = state.shared;
+	shared.routeRestoreArmedIds ??= /* @__PURE__ */ new Set();
+	if (shared.routeRestoreArmedIds.has(name)) return;
+	const inject = ctx.inject;
+	if (typeof inject !== "function") {
+		await ensureLoggedInProviderRoute(ctx, state, name, config);
+		return;
+	}
+	shared.routeRestoreArmedIds.add(name);
+	inject.call(ctx, ["credentials"], (scope) => {
+		ensureLoggedInProviderRoute(scope, state, name, config).catch((error) => logger(ctx).warn(`[pi2dsh] could not restore the route for logged-in provider ${JSON.stringify(name)}: ${error instanceof Error ? error.message : String(error)}`));
+	});
+}
 async function ensureLoggedInProviderRoute(ctx, state, name, config) {
 	if (!providerSupportsOAuth(config)) return false;
 	if (providerCarriesTransport(config) || state.providerRouteDisposers.has(name)) return false;
@@ -6364,11 +6329,16 @@ async function projectAuthorizationFlow(scope, state, providerId) {
 							throw error;
 						}
 					},
-					deviceCode: async (title, detail) => {
+					deviceCode: (title, detail, signal) => {
 						session.notify({
 							message: String(title),
 							code: String(detail)
 						});
+						return new Promise((resolve) => {
+							if (!(signal instanceof AbortSignal)) return;
+							if (signal.aborted) resolve();
+							else signal.addEventListener("abort", () => resolve(), { once: true });
+						});
 					}
 				};
 				const canonical = canonicalOf();
@@ -7365,7 +7335,7 @@ async function applyPiPackage(ctx, options) {
 	}
 	ensureLoginCommand(ctx, state);
 	for (const [name, config] of [...state.providers]) try {
-		await ensureLoggedInProviderRoute(ctx, state, name, config);
+		await restoreLoggedInRouteWhenReady(ctx, state, name, config);
 	} catch (error) {
 		logger(ctx).warn(`[pi2dsh] could not restore the route for logged-in provider ${JSON.stringify(name)}: ${error instanceof Error ? error.message : String(error)}`);
 	}
@@ -7448,6 +7418,131 @@ async function applyPiPackage(ctx, options) {
 					ok: true,
 					note: "run /reload (or restart the session) to apply"
 				};
+			},
+			async loginState() {
+				const flow = state.shared.browserLogin;
+				return {
+					providers: await Promise.all([...state.providers.entries()].filter(([, config]) => providerSupportsOAuth(config)).map(async ([id, config]) => ({
+						id,
+						name: config.oauth?.name ?? id,
+						signedIn: await storedOAuthCredential(oauthStoreOf(state), id).then((c) => c !== void 0, () => false)
+					}))),
+					...flow === void 0 ? {} : { flow: {
+						provider: flow.provider,
+						providerName: flow.providerName,
+						notices: flow.notices,
+						...flow.question === void 0 ? {} : { question: {
+							id: flow.question.id,
+							kind: flow.question.kind,
+							title: flow.question.title,
+							...flow.question.placeholder === void 0 ? {} : { placeholder: flow.question.placeholder },
+							...flow.question.options === void 0 ? {} : { options: flow.question.options }
+						} },
+						...flow.done === void 0 ? {} : { done: flow.done }
+					} }
+				};
+			},
+			async loginAction(action, provider, value) {
+				const shared = state.shared;
+				if (action === "dismiss") {
+					shared.browserLogin = void 0;
+					return { ok: true };
+				}
+				if (action === "answer") {
+					const flow = shared.browserLogin;
+					if (flow?.answer === void 0) throw new TypeError("no login question is waiting for an answer");
+					const settle = flow.answer;
+					flow.answer = void 0;
+					delete flow.question;
+					settle(value);
+					return { ok: true };
+				}
+				if (action === "cancel") {
+					const cancelled = await supersedeActiveLogin(state);
+					const flow = shared.browserLogin;
+					if (flow !== void 0 && flow.done === void 0) flow.done = {
+						ok: false,
+						summary: "Login cancelled"
+					};
+					return {
+						ok: true,
+						...cancelled === void 0 ? {} : { cancelled }
+					};
+				}
+				const config = state.providers.get(provider);
+				if (config === void 0 || !providerSupportsOAuth(config)) throw new TypeError(`unknown OAuth provider ${JSON.stringify(provider)}`);
+				const providerName = config.oauth?.name ?? provider;
+				if (action === "signout") {
+					await oauthStoreOf(state).delete(provider);
+					if (!providerCarriesTransport(config)) retireSharedProviderRoute(shared, provider);
+					return {
+						ok: true,
+						signedOut: provider
+					};
+				}
+				if (action !== "begin") throw new TypeError(`unknown login action ${JSON.stringify(action)}`);
+				let questionSeq = 0;
+				const flow = {
+					provider,
+					providerName,
+					notices: []
+				};
+				shared.browserLogin = flow;
+				const ask = (kind, title, extras, signal) => new Promise((resolve) => {
+					const id = ++questionSeq;
+					flow.question = {
+						id,
+						kind,
+						title,
+						...extras
+					};
+					flow.answer = (answered) => {
+						resolve(answered);
+					};
+					const withdraw = () => {
+						if (flow.question?.id !== id) return;
+						delete flow.question;
+						flow.answer = void 0;
+						resolve(void 0);
+					};
+					if (signal !== void 0) {
+						if (signal.aborted) withdraw();
+						else signal.addEventListener("abort", withdraw, { once: true });
+					}
+				});
+				runProviderLogin(ctx, state, provider, config, {
+					notify: (message) => {
+						flow.notices.push({ message: String(message) });
+					},
+					input: (title, placeholder, signal) => ask("input", String(title), typeof placeholder === "string" && placeholder.length > 0 ? { placeholder } : {}, signal),
+					select: (title, options, signal) => ask("select", String(title), { options: options.map((option) => String(option)) }, signal),
+					deviceCode: (title, detail, signal) => {
+						const code = /`([^`]+)`/u.exec(String(detail))?.[1];
+						flow.notices.push({
+							message: String(title),
+							...code === void 0 ? {} : { code }
+						});
+						return new Promise((resolve) => {
+							if (!(signal instanceof AbortSignal)) return;
+							if (signal.aborted) resolve();
+							else signal.addEventListener("abort", () => resolve(), { once: true });
+						});
+					}
+				}).then((summary) => {
+					if (shared.browserLogin === flow) flow.done = {
+						ok: true,
+						summary
+					};
+				}, (error) => {
+					if (shared.browserLogin === flow) flow.done = {
+						ok: false,
+						summary: error instanceof Error ? error.message : String(error)
+					};
+				});
+				return {
+					ok: true,
+					started: provider
+				};
 			}
 		});
 	}
@@ -7671,4 +7766,4 @@ const runtimeInternals = {
 //#endregion
 export { overlayProviderConfig as a, runtimeInternals as c, normalizeToolSchema as i, getSharedChildExtensionCatalog as n, registerChildExtensionCatalog as o, mergeProviderRegistration as r, registerVisionCompanions as s, applyPiPackage as t };
 
-//# sourceMappingURL=runtime-Dnk9mhrc.mjs.map
+//# sourceMappingURL=runtime-BiHMcD_8.mjs.map