pikibun 0.19.0 → 0.21.0

package/README.md

@@ -122,14 +122,21 @@ The sandbox has no network, so `gh` and `curl` inside it can't reach GitHub. Age
 - `github_comment` posts a comment. It waits for a human approval unless the session owner's message chose **Auto-approve**.
 - `github_issue` opens an issue with exactly the approved title and body in one of those repositories, and gives the agent its number and URL (connector newer than 0.9.0). It waits for a human approval unless the session owner's message chose **Auto-approve**. If GitHub refuses (issues turned off, no access), no issue is opened and the agent gets GitHub's reason.
 
-## Web pages and search
+## Extensions
 
-Agents read web pages with `web_fetch` and search the web with `web_search` (connector newer than 0.9.0).
+Sessions on this host run the Pi extensions their workspace chose that are installed here at the same version. The host's owner installs them from Pikibun (the host's page), or here:
 
-- `web_fetch` reads one `https://` page from this host, as far as the workspace's network access lets the session's sandbox reach, and never at an address in this host's own networks. It sends no cookies or credentials and only reads; HTML comes back as text, images as images. It needs no approval, during a shared message. On a host running without the sandbox it still follows the workspace's network access.
-- `web_search` asks Pikibun, which searches with the provider its operator configured, where the workspace turned web search on. The provider's key never reaches this host.
+```sh
+npx pikibun@latest extensions add npm:cc-safety-net@2.7.2         # an exact version
+npx pikibun@latest extensions add git:github.com/acme/ext@<commit>  # a full commit, over https
+npx pikibun@latest extensions add ./my-extension.ts                # a dev extension: your own sessions only
+npx pikibun@latest extensions list                                 # what each offers, ignores, or why it doesn't load
+npx pikibun@latest extensions remove cc-safety-net
+```
 
-What they return is untrusted input, like any repository content.
+They live in the connector's state directory; npm runs none of their install scripts unless you add `--allow-scripts`. A running connector picks up changes made here within half a minute. `pikibun connect --no-remote-installs` refuses installs asked for in Pikibun.
+
+Extensions run in the connector, as this machine's user, with your files, credentials and network, outside the sandbox. Install only code you trust. Their tool calls are approved like host commands. Pikibun's own `web_fetch` and `web_search` tools are retired: web search comes from extensions.
 
 ## Chat options
 
@@ -160,3 +167,11 @@ npx pikibun@latest serve
 runs the Pikibun server and its web app on `http://127.0.0.1:7878`, reachable from this computer only, with this computer as the host that runs your sessions. You sign in with GitHub through an OAuth app of your own: register one once at <https://github.com/settings/applications/new> with the homepage `http://127.0.0.1` and the callback URL `http://127.0.0.1/api/auth/github/callback`, and the first run asks for its client ID and secret (hidden). It then prints a sign-in link: the GitHub account that signs in through it becomes the owner, and the only account that can sign in. Once you have, this computer pairs itself as your host, sandboxed as with `connect` (or with `--unsafe-no-sandbox`; `--no-host` serves without it).
 
 Everything is kept in `~/.local/share/pikibun/server` (`--state-dir`), apart from `connect`'s own state, so later runs need no options. Run `npx pikibun serve --help` for the rest.
+
+### Sharing it with others
+
+```sh
+npx pikibun@latest serve --share --public-origin https://pikibun.example.com --admin github:12345 --password-auth --create-admin admin
+```
+
+runs the same server from the same data as a full multi-user Pikibun: people sign in at the public HTTPS address, create workspaces, and pair their own machines with `connect`. It still serves plain HTTP on `127.0.0.1:7878` (`--listen all` for every interface); a TLS proxy or tunnel you run (`tailscale serve`, Cloudflare Tunnel, Caddy) serves the public address and forwards to it, with `--trust-proxy` if it sets `X-Forwarded-Proto`/`-Host`. `--admin` lists the administrators by user ID (repeatable; `https://api.github.com/users/<login>` shows a GitHub account's numeric ID), and the first of them with an account owns this computer's host. `--signup` decides who may create an account (`invite`, the default, `open` or `off`). People sign in with GitHub through an OAuth app whose callback is `<public origin>/api/auth/github/callback` (`--github-client-id`, its secret as before), with usernames and passwords (`--password-auth`), or both; `--create-admin USERNAME` makes a listed `password:` administrator's account, asking for its password at a hidden prompt. The settings are remembered, so later runs need only `--share`; without it, the same data serves you alone again.