pi2web 0.2.0 → 0.2.6

package/dist/http/system-prompt-routes.js

@@ -0,0 +1,52 @@
+import { readPiPromptFiles, writePiPromptFile } from '../agent-templates.js';
+import { json } from './utils.js';
+const invalid = (message) => Object.assign(new Error(message), { code: 'INVALID_REQUEST' });
+/**
+ * `/api/v1/system-prompt` exposes Pi's own global prompt files (`~/.pi/agent/SYSTEM.md`, `APPEND_SYSTEM.md`) and a
+ * preview of the effective prompt; `/api/v1/agent-templates` manages the shareable template files in the data dir.
+ */
+export async function handleSystemPromptRoutes(ctx, req, res, u, parts) {
+    const send = (status, data) => {
+        json(res, status, data);
+        return true;
+    };
+    if (u.pathname === '/api/v1/system-prompt') {
+        if (req.method === 'GET')
+            return send(200, { data: readPiPromptFiles() });
+        if (req.method === 'PUT') {
+            const b = await ctx.body();
+            if (b.kind !== 'system' && b.kind !== 'append')
+                throw invalid('kind must be system or append');
+            if (typeof b.content !== 'string')
+                throw invalid('content must be a string');
+            writePiPromptFile(b.kind, b.content);
+            return send(200, { data: readPiPromptFiles() });
+        }
+    }
+    if (req.method === 'GET' && u.pathname === '/api/v1/system-prompt/preview') {
+        const workspaceId = u.searchParams.get('workspaceId') ?? '', relativeCwd = u.searchParams.get('relativeCwd') ?? '.', templateId = u.searchParams.get('templateId') || '', piDefaultPrompt = u.searchParams.get('source') === 'pi-default';
+        const template = templateId && !piDefaultPrompt ? ctx.templates.snapshot(templateId) : undefined;
+        return send(200, {
+            data: {
+                ...(await ctx.agents.systemPromptPreview(workspaceId, relativeCwd, { template, piDefaultPrompt })),
+                template: template ?? null
+            }
+        });
+    }
+    if (parts[2] === 'agent-templates') {
+        if (parts.length === 3 && req.method === 'GET')
+            return send(200, { data: { dir: ctx.templates.dir, ...ctx.templates.list() } });
+        if (parts.length === 4) {
+            const id = decodeURIComponent(parts[3]);
+            if (req.method === 'GET')
+                return send(200, { data: ctx.templates.get(id) });
+            if (req.method === 'PUT')
+                return send(200, { data: ctx.templates.save(id, await ctx.body()) });
+            if (req.method === 'DELETE') {
+                ctx.templates.remove(id);
+                return send(200, { data: { deleted: true } });
+            }
+        }
+    }
+    return false;
+}

package/dist/http/utils.js

@@ -0,0 +1,43 @@
+export const LOOPBACK_HOSTS = ['127.0.0.1', '::1', 'localhost'];
+export const isLoopbackHost = (value) => {
+    try {
+        return LOOPBACK_HOSTS.includes(new URL(`http://${value}`).hostname.replace(/^\[|\]$/g, ''));
+    }
+    catch {
+        return false;
+    }
+};
+export const json = (res, status, data) => {
+    res.statusCode = status;
+    res.setHeader('content-type', 'application/json');
+    res.end(JSON.stringify(data));
+};
+export async function readBinaryBody(req, maxBytes = 25 * 1024 * 1024) {
+    const chunks = [];
+    let size = 0;
+    for await (const value of req) {
+        const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
+        size += chunk.length;
+        if (size > maxBytes)
+            throw Object.assign(new Error('Request too large'), { code: 'REQUEST_TOO_LARGE' });
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+/** Reads a JSON body as bytes so the size limit applies while streaming and multi-byte characters are never split across chunks. */
+export async function readJsonBody(req, maxBytes = 2 * 1024 * 1024) {
+    const raw = await readBinaryBody(req, maxBytes);
+    return raw.length ? JSON.parse(raw.toString('utf8')) : {};
+}
+/** Maps a thrown error's `code` to the HTTP status used by every REST endpoint. */
+export function errorStatus(code) {
+    if (code === 'WORKSPACE_PATH_OUTSIDE_ROOT')
+        return 403;
+    if (code === 'FILE_TOO_LARGE' || code === 'REQUEST_TOO_LARGE')
+        return 413;
+    if (code === 'VOICE_DISABLED' || code === 'VOICE_STT_DISABLED' || code === 'MAIL_NOTIFICATIONS_DISABLED')
+        return 503;
+    if (code?.endsWith('NOT_FOUND'))
+        return 404;
+    return 400;
+}

package/dist/http/web-assets.js

@@ -0,0 +1,63 @@
+import path from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { createHash } from 'node:crypto';
+import { json } from './utils.js';
+const webRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../web'), require = createRequire(import.meta.url);
+const markedBrowser = path.join(path.dirname(require.resolve('marked/package.json')), 'lib', 'marked.umd.js');
+const webFiles = {
+    '/': { file: 'index.html', type: 'text/html; charset=utf-8' },
+    '/index.html': { file: 'index.html', type: 'text/html; charset=utf-8' },
+    '/app.js': { file: 'app.js', type: 'text/javascript; charset=utf-8' },
+    '/backend-state.js': { file: 'backend-state.js', type: 'text/javascript; charset=utf-8' },
+    '/hid-keyboard.js': { file: 'hid-keyboard.js', type: 'text/javascript; charset=utf-8' },
+    '/activity-view.js': { file: 'activity-view.js', type: 'text/javascript; charset=utf-8' },
+    '/collab': { file: 'collab.html', type: 'text/html; charset=utf-8' },
+    '/collab.html': { file: 'collab.html', type: 'text/html; charset=utf-8' },
+    '/collab.js': { file: 'collab.js', type: 'text/javascript; charset=utf-8' },
+    '/styles.css': { file: 'styles.css', type: 'text/css; charset=utf-8' },
+    '/icon.svg': { file: 'icon.svg', type: 'image/svg+xml' },
+    '/favicon.ico': { file: 'icon.svg', type: 'image/svg+xml' },
+    '/vendor/xterm.js': { file: require.resolve('@xterm/xterm'), type: 'text/javascript; charset=utf-8' },
+    '/vendor/xterm.css': { file: require.resolve('@xterm/xterm/css/xterm.css'), type: 'text/css; charset=utf-8' },
+    '/vendor/addon-fit.js': { file: require.resolve('@xterm/addon-fit'), type: 'text/javascript; charset=utf-8' },
+    '/vendor/marked.js': { file: markedBrowser, type: 'text/javascript; charset=utf-8' },
+    '/vendor/dompurify.js': {
+        file: require.resolve('dompurify/purify.min.js'),
+        type: 'text/javascript; charset=utf-8'
+    }
+};
+/** Serves a bundled Web UI or vendor file. Returns false when `pathname` is not a static asset. */
+export async function serveWebAsset(pathname, req, res, options) {
+    const asset = webFiles[pathname];
+    if (!asset)
+        return false;
+    try {
+        const content = await readFile(path.isAbsolute(asset.file) ? asset.file : path.join(webRoot, asset.file)), etag = `"${createHash('sha256').update(content).digest('base64url')}"`, ifNoneMatch = String(req.headers['if-none-match'] ?? '')
+            .split(',')
+            .map(value => value.trim().replace(/^W\//, ''));
+        res.setHeader('content-type', asset.type);
+        res.setHeader('cache-control', pathname.startsWith('/vendor/') ? 'public, max-age=86400' : 'no-cache');
+        res.setHeader('etag', etag);
+        res.setHeader('x-content-type-options', 'nosniff');
+        if (options.noAuth && asset.type.startsWith('text/html'))
+            res.setHeader('content-security-policy', "frame-ancestors 'self'");
+        if (ifNoneMatch.includes(etag) || ifNoneMatch.includes('*')) {
+            res.statusCode = 304;
+            res.end();
+            return true;
+        }
+        res.statusCode = 200;
+        res.end(content);
+    }
+    catch {
+        json(res, 500, {
+            error: {
+                code: 'WEB_UI_UNAVAILABLE',
+                message: 'Web UI files are missing. Reinstall the pi2web package.'
+            }
+        });
+    }
+    return true;
+}

package/dist/http/workspace-routes.js

@@ -0,0 +1,58 @@
+import { json, readJsonBody } from './utils.js';
+/** Handles Workspace files, the Session index and Terminal REST routes. Returns false for any other route. */
+export async function handleWorkspaceRoutes(ctx, req, res, u, parts, requestId) {
+    const send = (status, data) => {
+        json(res, status, data);
+        return true;
+    };
+    if (req.method === 'GET' && u.pathname === '/api/v1/workspaces')
+        return send(200, { data: ctx.workspaces.list() });
+    if (req.method === 'POST' && u.pathname === '/api/v1/workspaces') {
+        const b = await readJsonBody(req);
+        if (typeof b.label !== 'string' || typeof b.rootPath !== 'string')
+            return send(400, {
+                error: { code: 'INVALID_REQUEST', message: 'label and rootPath required', requestId }
+            });
+        const workspace = ctx.workspaces.add(b.label, b.rootPath);
+        ctx.metadata.saveWorkspace(workspace);
+        return send(201, { data: workspace });
+    }
+    if (parts[2] === 'workspaces' && parts[4] === 'tree' && req.method === 'GET')
+        return send(200, {
+            data: await ctx.workspaces.tree(parts[3], u.searchParams.get('path') ?? '.')
+        });
+    if (parts[2] === 'workspaces' && parts[4] === 'file' && req.method === 'GET')
+        return send(200, {
+            data: await ctx.workspaces.file(parts[3], u.searchParams.get('path') ?? '', Number(u.searchParams.get('offset') ?? 0), Number(u.searchParams.get('limit') ?? 1048576))
+        });
+    if (parts[2] === 'workspaces' && parts[4] === 'stat' && req.method === 'GET')
+        return send(200, {
+            data: await ctx.workspaces.stat(parts[3], u.searchParams.get('path') ?? '.')
+        });
+    if (req.method === 'GET' && u.pathname === '/api/v1/sessions') {
+        const workspace = ctx.workspaces.get(u.searchParams.get('workspaceId') ?? '');
+        if (!workspace)
+            throw Object.assign(new Error('Workspace not found'), { code: 'WORKSPACE_NOT_FOUND' });
+        const cwd = await ctx.workspaces.resolve(workspace, u.searchParams.get('path') ?? '.');
+        await ctx.ensureSessionIndex(workspace, cwd, u.searchParams.get('refresh') === 'true');
+        const limit = u.searchParams.has('limit') ? Number(u.searchParams.get('limit')) : undefined, offset = Number(u.searchParams.get('offset') ?? 0);
+        return send(200, { data: ctx.metadata.listSessions(cwd, limit, offset) });
+    }
+    if (req.method === 'GET' && u.pathname === '/api/v1/terminals')
+        return send(200, { data: ctx.terminals.list() });
+    if (req.method === 'POST' && u.pathname === '/api/v1/terminals') {
+        const b = await readJsonBody(req);
+        const terminal = await ctx.terminals.create(String(b.workspaceId ?? ''), String(b.relativeCwd ?? '.'), Number(b.cols ?? 80), Number(b.rows ?? 24));
+        return send(201, { data: terminal });
+    }
+    if (parts[2] === 'terminals') {
+        const id = parts[3];
+        if (req.method === 'GET' && parts.length === 4)
+            return send(200, { data: ctx.terminals.get(id).record });
+        if (req.method === 'DELETE' && parts.length === 4) {
+            ctx.terminals.close(id);
+            return send(200, { data: { closed: true } });
+        }
+    }
+    return false;
+}

package/dist/mail-notifier.js

@@ -1,11 +1,23 @@
 import { randomUUID } from 'node:crypto';
 import { assistantText } from './voice.js';
-const defaultSettings = { enabled: true, aggregationDelaySeconds: 0, includeResponse: true, includeSessionDetails: true };
+const defaultSettings = {
+    enabled: true,
+    aggregationDelaySeconds: 0,
+    includeResponse: true,
+    includeSessionDetails: true,
+    collabEscalations: true
+};
 const clip = (value, max) => value.length <= max ? value : `${value.slice(0, max)}\n\n[内容过长，已截断]`;
-const oneLine = (value, max) => value.replace(/[\r\n\t]+/g, ' ').replace(/\s{2,}/g, ' ').trim().slice(0, max);
+const oneLine = (value, max) => value
+    .replace(/[\r\n\t]+/g, ' ')
+    .replace(/\s{2,}/g, ' ')
+    .trim()
+    .slice(0, max);
 export class MailNotifier {
     fetcher;
     lastAssistant = new Map();
+    /** Agents with a run in progress. A run may emit duplicate settled events; notify only once. */
+    activeRuns = new Set();
     queue = [];
     timer;
     pending = new Set();
@@ -16,15 +28,22 @@ export class MailNotifier {
         this.fetcher = fetcher;
         this.config = { priority: 100, timeoutMs: 15_000, ...config };
     }
-    getSettings() { return { ...this.settings }; }
+    getSettings() {
+        return { ...this.settings };
+    }
     updateSettings(value) {
         const next = { ...this.settings, ...value };
         next.enabled = Boolean(next.enabled);
         next.includeResponse = Boolean(next.includeResponse);
         next.includeSessionDetails = Boolean(next.includeSessionDetails);
+        next.collabEscalations = Boolean(next.collabEscalations);
         next.aggregationDelaySeconds = Math.trunc(Number(next.aggregationDelaySeconds));
-        if (!Number.isFinite(next.aggregationDelaySeconds) || next.aggregationDelaySeconds < 0 || next.aggregationDelaySeconds > 86400)
-            throw Object.assign(new Error('aggregationDelaySeconds must be an integer between 0 and 86400'), { code: 'INVALID_MAIL_NOTIFICATION_SETTINGS' });
+        if (!Number.isFinite(next.aggregationDelaySeconds) ||
+            next.aggregationDelaySeconds < 0 ||
+            next.aggregationDelaySeconds > 86400)
+            throw Object.assign(new Error('aggregationDelaySeconds must be an integer between 0 and 86400'), {
+                code: 'INVALID_MAIL_NOTIFICATION_SETTINGS'
+            });
         this.settings = next;
         if (!next.enabled) {
             this.clearTimer();
@@ -40,22 +59,40 @@ export class MailNotifier {
     handleAgentEvent(agentId, event, context = {}) {
         if (this.closed)
             return;
+        if (event.type === 'before_agent_start' || event.type === 'agent_start') {
+            this.activeRuns.add(agentId);
+            return;
+        }
         if (event.type === 'message_end') {
+            this.activeRuns.add(agentId);
             const text = assistantText(event.message);
             if (text)
                 this.lastAssistant.set(agentId, text);
             return;
         }
-        if (event.type !== 'agent_settled')
+        if (event.type !== 'agent_settled' || !this.activeRuns.delete(agentId))
             return;
         const finalOutput = this.lastAssistant.get(agentId) ?? '';
         this.lastAssistant.delete(agentId);
         if (!this.settings.enabled)
             return;
-        this.queue.push({ agentId, finalOutput, context });
+        // Pi 0.99+ reports whether the run was cancelled; a cancelled run is not a completed task.
+        this.queue.push({ agentId, finalOutput, context, aborted: event.aborted === true });
         if (!this.timer)
             this.scheduleFlush();
     }
+    /**
+     * Fire-and-forget notification that bypasses the agent-completion queue. Used by the collaboration hub:
+     * a pending human ruling blocks the whole session, so it must not wait for the aggregation window.
+     */
+    notifyCollab(input) {
+        if (this.closed || !this.settings.enabled || !this.settings.collabEscalations)
+            return;
+        const job = this.sendMail(input.subject, clip(input.text, 24_000), { kind: 'collab' }).catch(error => console.error(`MailDispatch collaboration notification failed: ${error.message}`));
+        this.pending.add(job);
+        void job.finally(() => this.pending.delete(job));
+        return job;
+    }
     async close() {
         this.closed = true;
         this.clearTimer();
@@ -63,6 +100,7 @@ export class MailNotifier {
             await this.flushQueue();
         await Promise.allSettled([...this.pending]);
         this.lastAssistant.clear();
+        this.activeRuns.clear();
     }
     scheduleFlush() {
         const delay = this.settings.aggregationDelaySeconds * 1000;
@@ -70,7 +108,10 @@ export class MailNotifier {
             this.startFlush();
             return;
         }
-        this.timer = setTimeout(() => { this.timer = undefined; this.startFlush(); }, delay);
+        this.timer = setTimeout(() => {
+            this.timer = undefined;
+            this.startFlush();
+        }, delay);
         this.timer.unref?.();
     }
     startFlush() {
@@ -86,24 +127,39 @@ export class MailNotifier {
         if (this.queue.length && !this.timer && !this.closed)
             this.scheduleFlush();
     }
-    clearTimer() { if (this.timer) {
-        clearTimeout(this.timer);
-        this.timer = undefined;
-    } }
+    clearTimer() {
+        if (this.timer) {
+            clearTimeout(this.timer);
+            this.timer = undefined;
+        }
+    }
     async sendBatch(items) {
         const includeResponse = this.settings.includeResponse, includeSessionDetails = this.settings.includeSessionDetails, count = items.length;
-        let subject = `[Remote Pi] ${count > 1 ? `${count} 个 Agent 任务` : 'Agent 任务'}已完成`;
+        const aborted = items.filter(item => item.aborted).length;
+        // A mixed batch is neither completed nor interrupted, so it says how many of each.
+        const verb = aborted === count ? '已中断' : aborted ? `已结束（${aborted} 个被中断）` : '已完成';
+        let subject = `[Remote Pi] ${count > 1 ? `${count} 个 Agent 任务` : 'Agent 任务'}${verb}`;
         if (count === 1 && includeSessionDetails) {
             const label = oneLine(items[0].context.sessionName || '', 80);
             if (label)
-                subject = `[Remote Pi] ${label}已完成`;
+                subject = `[Remote Pi] ${label}${verb}`;
         }
         let text;
         if (!includeResponse && !includeSessionDetails)
-            text = count > 1 ? `${count} 个 Agent 任务已完成。` : '有 Agent 任务完成。';
+            text =
+                count > 1
+                    ? `${count} 个 Agent 任务${verb}。`
+                    : aborted
+                        ? '有 Agent 任务被中断。'
+                        : '有 Agent 任务完成。';
         else
-            text = items.map((item, index) => {
-                const lines = count > 1 ? [`任务 ${index + 1}`] : [];
+            text = items
+                .map((item, index) => {
+                const lines = count > 1
+                    ? [`任务 ${index + 1}${item.aborted ? '（已中断）' : ''}`]
+                    : item.aborted
+                        ? ['任务已中断']
+                        : [];
                 if (includeSessionDetails) {
                     lines.push(`Session：${item.context.sessionName?.trim() || '未命名'}`);
                     if (item.context.cwd)
@@ -115,14 +171,32 @@ export class MailNotifier {
                     lines.push('Agent 回复：', clip(item.finalOutput.trim() || '（没有可用的最终文本回复）', 24_000));
                 }
                 return lines.join('\n');
-            }).join('\n\n--------------------\n\n');
+            })
+                .join('\n\n--------------------\n\n');
+        await this.sendMail(subject, text, { task_count: count, aborted_count: aborted });
+    }
+    async sendMail(subject, text, metadata = {}) {
         const payload = {
-            to: [this.config.recipient], subject, text, priority: this.config.priority, purpose: 'transactional',
-            metadata: { source: 'remote-pi', task_count: count, notification_id: randomUUID() }
+            to: [this.config.recipient],
+            subject,
+            text,
+            priority: this.config.priority,
+            purpose: 'transactional',
+            metadata: { source: 'pi2web', ...metadata, notification_id: randomUUID() }
         };
         if (this.config.senderId)
             payload.sender_id = this.config.senderId;
-        const response = await this.fetcher(this.config.endpoint, { method: 'POST', signal: AbortSignal.timeout(this.config.timeoutMs), headers: { authorization: `Bearer ${this.config.apiKey}`, 'content-type': 'application/json; charset=utf-8', accept: 'application/json', 'idempotency-key': randomUUID() }, body: JSON.stringify(payload) });
+        const response = await this.fetcher(this.config.endpoint, {
+            method: 'POST',
+            signal: AbortSignal.timeout(this.config.timeoutMs),
+            headers: {
+                authorization: `Bearer ${this.config.apiKey}`,
+                'content-type': 'application/json; charset=utf-8',
+                accept: 'application/json',
+                'idempotency-key': randomUUID()
+            },
+            body: JSON.stringify(payload)
+        });
         if (!response.ok)
             throw new Error(`HTTP ${response.status}: ${(await response.text()).slice(0, 500)}`);
         const result = await response.json().catch(() => undefined);

package/dist/main.js

@@ -1,17 +1,30 @@
 #!/usr/bin/env node
-import { RemotePiServer } from './server.js';
+import { RemotePiServer, LOOPBACK_HOSTS } from './server.js';
+import { defaultDataDir } from './paths.js';
 import { VoiceManager } from './voice.js';
+import { SessionNamer, DEFAULT_SESSION_NAMER } from './session-namer.js';
 import { MailNotifier } from './mail-notifier.js';
 import pkg from '../package.json' with { type: 'json' };
 const args = process.argv.slice(2);
-const value = (name, fallback) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] ?? fallback : fallback; };
-const envSecret = (flag) => { const name = value(flag, '').trim(); if (!name)
-    return undefined; const result = process.env[name]; if (!result) {
-    console.error(`${flag} references missing environment variable ${name}`);
-    process.exit(1);
-} return result; };
+const value = (name, fallback) => {
+    const i = args.indexOf(name);
+    return i >= 0 ? (args[i + 1] ?? fallback) : fallback;
+};
+const envSecret = (flag) => {
+    const name = value(flag, '').trim();
+    if (!name)
+        return undefined;
+    const result = process.env[name];
+    if (!result) {
+        console.error(`${flag} references missing environment variable ${name}`);
+        process.exit(1);
+    }
+    return result;
+};
 if (args.includes('--help') || args.includes('-h')) {
-    console.log(`pi2web ${pkg.version}\n\nUsage: pi2web [options]\n\nOptions:\n  --host <address>                    Listen address (default: 127.0.0.1)\n  --port <number>                     Listen port (default: 11318)\n  --data-dir <path>                   Metadata directory (default: ~/.pi/remote-pi)\n  --maildispatch-endpoint <url>       MailDispatch message API endpoint\n  --maildispatch-api-key-env <name>   Environment variable containing the MailDispatch API key\n  --maildispatch-notify-to <email>    Email address notified when an Agent task settles\n  --maildispatch-sender-id <id>       Optional MailDispatch sender ID\n  --voice-base-url <url>              OpenAI-compatible TTS endpoint, e.g. Speaches or openai-edge-tts\n  --voice-stt-model <id>              Optional speech-to-text model ID; omit for TTS-only mode\n  --voice-tts-model <id>              Text-to-speech model ID\n  --voice-tts-voice <id>              TTS voice ID\n  --voice-tts-format <pcm|mp3>         TTS response format (default: pcm)\n  --voice-api-key-env <name>          Environment variable containing the speech API key\n  --voice-summary-base-url <url>      OpenAI-compatible summary LLM endpoint\n  --voice-summary-model <id>          Summary LLM model ID\n  --voice-summary-api-key-env <name>  Environment variable containing the summary API key\n  --voice-language <tag>              Spoken summary language (default: zh-CN)\n  --voice-request-timeout <ms>        Speech and summary request timeout (default: 120000)\n  --rotate-access-token               Generate a new pairing code and exit\n  --version                           Print version\n  -h, --help                          Show help\n\nMail notifications require endpoint, API-key environment variable, and recipient. Voice is disabled unless --voice-base-url is set. The Web UI is served at the same address. Its pairing code must be entered manually; the browser asks before saving it locally.`);
+    console.log(`pi2web ${pkg.version}\n\nUsage: pi2web [options]\n\nOptions:\n  --host <address>                    Listen address (default: 127.0.0.1)\n  --port <number>                     Listen port (default: 11318)\n  --data-dir <path>                   Data directory (default: ~/.pi/pi2web, env PI2WEB_DIR)\n  --maildispatch-endpoint <url>       MailDispatch message API endpoint\n  --maildispatch-api-key-env <name>   Environment variable containing the MailDispatch API key\n  --maildispatch-notify-to <email>    Email address notified when an Agent task settles\n  --maildispatch-sender-id <id>       Optional MailDispatch sender ID\n  --voice-base-url <url>              OpenAI-compatible TTS endpoint, e.g. Speaches or openai-edge-tts\n  --voice-stt-model <id>              Optional speech-to-text model ID; omit for TTS-only mode\n  --voice-tts-model <id>              Text-to-speech model ID\n  --voice-tts-voice <id>              TTS voice ID\n  --voice-tts-format <pcm|mp3>         TTS response format (default: pcm)\n  --voice-api-key-env <name>          Environment variable containing the speech API key\n  --voice-summary-base-url <url>      OpenAI-compatible summary LLM endpoint\n  --voice-summary-model <id>          Summary LLM model ID\n  --voice-summary-api-key-env <name>  Environment variable containing the summary API key\n  --voice-language <tag>              Spoken summary language (default: zh-CN)\n  --voice-request-timeout <ms>        Speech and summary request timeout (default: 120000)\n  --session-naming <on|off>           Automatic session naming (default: on)\n  --session-name-base-url <url>       OpenAI-compatible naming LLM endpoint (default: ${DEFAULT_SESSION_NAMER.baseUrl})\n  --session-name-model <id>           Naming LLM model ID (default: ${DEFAULT_SESSION_NAMER.model})\n  --session-name-api-key-env <name>   Environment variable containing the naming API key (default: none)\n  --session-name-language <tag>       Session name language (default: zh-CN)\n  --session-name-request-timeout <ms> Naming request timeout (default: 60000)\n  --session-name-max-output-tokens <n> Naming output token budget (default: ${DEFAULT_SESSION_NAMER.maxOutputTokens})\n  --rotate-access-token               Generate a new pairing code and exit\n  --create-voice-token                Create or replace a restricted voice token and exit\n  --revoke-voice-token                Revoke the restricted voice token and exit
+  --set-access-token <token>          Set a specific pairing code and exit
+  --set-access-token-env <name>       Set the pairing code from an environment variable and exit\n  --no-auth                           Disable pairing-code auth (loopback only by default)\n  --allow-insecure-no-auth             Allow non-loopback binds and any Host/Origin (requires --no-auth; DANGEROUS)\n  --version                           Print version\n  -h, --help                          Show help\n\nMail notifications require endpoint, API-key environment variable, and recipient. Voice is disabled unless --voice-base-url is set. Automatic session naming is independent of voice and on by default; disable it with --session-naming off. The Web UI is served at the same address. Its pairing code must be entered manually; the browser asks before saving it locally.`);
     process.exit(0);
 }
 if (args.includes('--version') || args.includes('-v')) {
@@ -23,13 +36,26 @@ if (!Number.isInteger(port) || port < 0 || port > 65535) {
     console.error('Invalid --port');
     process.exit(1);
 }
+const noAuth = args.includes('--no-auth'), allowInsecureNoAuth = args.includes('--allow-insecure-no-auth');
+if (allowInsecureNoAuth && !noAuth) {
+    console.error('--allow-insecure-no-auth requires --no-auth');
+    process.exit(1);
+}
+if (noAuth && !allowInsecureNoAuth && !LOOPBACK_HOSTS.includes(host.trim())) {
+    console.error('--no-auth requires --host 127.0.0.1, ::1 or localhost; use --allow-insecure-no-auth to explicitly allow remote access without authentication');
+    process.exit(1);
+}
 const voiceBaseUrl = value('--voice-base-url', '');
 let voice;
 if (voiceBaseUrl) {
-    const required = (name) => { const result = value(name, '').trim(); if (!result) {
-        console.error(`${name} is required when voice is enabled`);
-        process.exit(1);
-    } return result; };
+    const required = (name) => {
+        const result = value(name, '').trim();
+        if (!result) {
+            console.error(`${name} is required when voice is enabled`);
+            process.exit(1);
+        }
+        return result;
+    };
     const ttsFormat = value('--voice-tts-format', 'pcm').trim();
     if (ttsFormat !== 'pcm' && ttsFormat !== 'mp3') {
         console.error('--voice-tts-format must be pcm or mp3');
@@ -40,9 +66,47 @@ if (voiceBaseUrl) {
         console.error('--voice-request-timeout must be an integer of at least 1000 milliseconds');
         process.exit(1);
     }
-    const config = { speechBaseUrl: voiceBaseUrl, sttModel: value('--voice-stt-model', '').trim() || undefined, ttsModel: required('--voice-tts-model'), ttsVoice: required('--voice-tts-voice'), ttsFormat, speechApiKey: envSecret('--voice-api-key-env'), summaryBaseUrl: required('--voice-summary-base-url'), summaryModel: required('--voice-summary-model'), summaryApiKey: envSecret('--voice-summary-api-key-env'), language: value('--voice-language', 'zh-CN'), requestTimeoutMs };
+    const config = {
+        speechBaseUrl: voiceBaseUrl,
+        sttModel: value('--voice-stt-model', '').trim() || undefined,
+        ttsModel: required('--voice-tts-model'),
+        ttsVoice: required('--voice-tts-voice'),
+        ttsFormat,
+        speechApiKey: envSecret('--voice-api-key-env'),
+        summaryBaseUrl: required('--voice-summary-base-url'),
+        summaryModel: required('--voice-summary-model'),
+        summaryApiKey: envSecret('--voice-summary-api-key-env'),
+        language: value('--voice-language', 'zh-CN'),
+        requestTimeoutMs
+    };
     voice = new VoiceManager(config);
 }
+const namingMode = value('--session-naming', 'on').trim().toLowerCase();
+if (!['on', 'off'].includes(namingMode)) {
+    console.error('--session-naming must be on or off');
+    process.exit(1);
+}
+let sessionNamer;
+if (namingMode === 'on') {
+    const namingTimeoutMs = Number(value('--session-name-request-timeout', String(DEFAULT_SESSION_NAMER.requestTimeoutMs)));
+    if (!Number.isInteger(namingTimeoutMs) || namingTimeoutMs < 1000) {
+        console.error('--session-name-request-timeout must be an integer of at least 1000 milliseconds');
+        process.exit(1);
+    }
+    const namingMaxTokens = Number(value('--session-name-max-output-tokens', String(DEFAULT_SESSION_NAMER.maxOutputTokens)));
+    if (!Number.isInteger(namingMaxTokens) || namingMaxTokens < 16) {
+        console.error('--session-name-max-output-tokens must be an integer of at least 16');
+        process.exit(1);
+    }
+    sessionNamer = new SessionNamer({
+        baseUrl: value('--session-name-base-url', DEFAULT_SESSION_NAMER.baseUrl).trim() || DEFAULT_SESSION_NAMER.baseUrl,
+        model: value('--session-name-model', DEFAULT_SESSION_NAMER.model).trim() || DEFAULT_SESSION_NAMER.model,
+        apiKey: envSecret('--session-name-api-key-env'),
+        language: value('--session-name-language', DEFAULT_SESSION_NAMER.language),
+        requestTimeoutMs: namingTimeoutMs,
+        maxOutputTokens: namingMaxTokens
+    });
+}
 const mailEndpoint = value('--maildispatch-endpoint', '').trim(), mailKeyEnv = value('--maildispatch-api-key-env', '').trim(), mailRecipient = value('--maildispatch-notify-to', '').trim();
 const mailParts = [mailEndpoint, mailKeyEnv, mailRecipient].filter(Boolean).length;
 if (mailParts > 0 && mailParts < 3) {
@@ -63,14 +127,69 @@ if (mailParts === 3) {
         console.error('--maildispatch-endpoint must use http or https');
         process.exit(1);
     }
-    mailNotifier = new MailNotifier({ endpoint: endpoint.toString(), apiKey: envSecret('--maildispatch-api-key-env'), recipient: mailRecipient, senderId: value('--maildispatch-sender-id', '').trim() || undefined });
+    mailNotifier = new MailNotifier({
+        endpoint: endpoint.toString(),
+        apiKey: envSecret('--maildispatch-api-key-env'),
+        recipient: mailRecipient,
+        senderId: value('--maildispatch-sender-id', '').trim() || undefined
+    });
 }
-const server = new RemotePiServer({ host, port, dataDir: value('--data-dir', process.env.PI_REMOTE_DIR ?? `${process.env.HOME ?? '.'}/.pi/remote-pi`), voice, mailNotifier });
+const server = new RemotePiServer({
+    host,
+    port,
+    noAuth,
+    allowInsecureNoAuth,
+    dataDir: value('--data-dir', defaultDataDir()),
+    voice,
+    sessionNamer,
+    mailNotifier
+});
 if (args.includes('--rotate-access-token')) {
     await server.auth.init();
     console.log(await server.auth.rotate());
     process.exit(0);
 }
+if (args.includes('--create-voice-token')) {
+    const first = await server.auth.init();
+    if (first.token)
+        console.error(`Remote Pi pairing code (shown once; save it securely): ${first.token}`);
+    console.error('Draft-only voice token (shown once):');
+    console.log(await server.auth.rotateVoice());
+    process.exit(0);
+}
+if (args.includes('--revoke-voice-token')) {
+    const first = await server.auth.init();
+    if (first.token)
+        console.error(`Remote Pi pairing code (shown once; save it securely): ${first.token}`);
+    await server.auth.revokeVoice();
+    console.error('Voice token revoked.');
+    process.exit(0);
+}
+if (args.includes('--set-access-token') || args.includes('--set-access-token-env')) {
+    const fromEnv = args.includes('--set-access-token-env'), flag = fromEnv ? '--set-access-token-env' : '--set-access-token';
+    let token = value(flag, '');
+    if (!token) {
+        console.error(`${flag} requires a value`);
+        process.exit(1);
+    }
+    if (fromEnv) {
+        const name = token;
+        token = process.env[name] ?? '';
+        if (!token) {
+            console.error(`${flag} references missing or empty environment variable ${name}`);
+            process.exit(1);
+        }
+    }
+    try {
+        await server.auth.setToken(token);
+        console.log('Pairing code updated. Use it to pair Web UI clients.');
+    }
+    catch (error) {
+        console.error(error.message);
+        process.exit(1);
+    }
+    process.exit(0);
+}
 if (args.includes('--print-access-token')) {
     console.error('The pairing code is only shown on first startup or rotation.');
     process.exit(1);
@@ -79,12 +198,17 @@ try {
     await server.start();
     const address = server.address();
     console.log(`Remote Pi is ready: http://${host}:${address?.port ?? port}`);
-    console.log('Open this URL and enter the pairing code manually.');
+    console.log(noAuth
+        ? 'Auth is disabled (--no-auth). Anyone who can reach this address can control the agents; leave the pairing code empty in the Web UI.'
+        : 'Open this URL and enter the pairing code manually.');
 }
 catch (error) {
     console.error(`Failed to start Remote Pi: ${error.message}`);
     process.exit(1);
 }
-const shutdown = async () => { await server.stop(); process.exit(0); };
+const shutdown = async () => {
+    await server.stop();
+    process.exit(0);
+};
 process.once('SIGINT', shutdown);
 process.once('SIGTERM', shutdown);