pikibun 0.23.1 → 0.25.0

package/dist/chunks/{cli-DRWVFHEJ.js → cli-COW3WXMB.js}

@@ -1,6 +1,7 @@
 import {
   API_CREDENTIAL_CACHE_SECONDS,
   COMPACTION_FAILURES,
+  CONNECTOR_VERSION_HEADER,
   ConnectorSetupError,
   CronError,
   GITHUB_ISSUE_BODY_LIMIT,
@@ -23,7 +24,9 @@ import {
   base64Bytes,
   bindingRemote,
   boundedStream,
+  buildVersion,
   builtinExtensionNames,
+  bundledToolDefinitions,
   checkBrowseResult,
   checkPrerequisites,
   confirmUnsandboxed,
@@ -39,10 +42,13 @@ import {
   decidedAsHostCommand,
   defaultHostBrowserConfig,
   defaultHostConfig,
+  defaultHostTunnelConfig,
   defaultNetworkPolicy,
   defaultWorkspaceExtensions,
   documentKind,
   documentKindNames,
+  documentKindsOff,
+  documentSourceExtensionOf,
   drainStream,
   dropboxItem,
   egressGitServices,
@@ -100,15 +106,19 @@ import {
   parseHostCompaction,
   parseHostConfigChange,
   parseHostExtensionsReport,
+  parseHostTunnelConfig,
   parseLfsBatchRequest,
   parseLfsObject,
   parseNetworkPolicy,
   parseRequiredExtensions,
+  parseSessionTunnelReport,
   parseUploadChunk,
   parseWorkspaceExtension,
   permissionNeeds,
   permissions,
   pikiExtension,
+  pikiExtensionOn,
+  pikiExtensions,
   pikiExtensionsFor,
   pikiSessionToolExtensions,
   plainRepositoryPath,
@@ -157,12 +167,13 @@ import {
   validRepositoryId,
   validRepositoryName,
   validSourceItem,
+  validVersion,
   validateUserEnv,
   verifyToken,
   workspaceDatabaseTlsModes,
   workspaceManagerRoles,
   workspaceSessionPermissions
-} from "./chunk-NAPYFPGG.js";
+} from "./chunk-3IXKVGAD.js";
 import {
   ConstraintError,
   migrationsDirectory,
@@ -566,7 +577,9 @@ function sessionRecord(row, grants) {
     ...row.tool_output === "brief" ? { toolOutput: "brief" } : {},
     ...row.parent_session_id ? { parentSessionId: row.parent_session_id } : {},
     ...row.packed_at ? { packed: true } : {},
-    ...pullRequest2 ? { pullRequest: pullRequest2 } : {}
+    ...pullRequest2 ? { pullRequest: pullRequest2 } : {},
+    // An archived session is never online, whatever a host that was away when it was archived said.
+    ...row.tunnel_url && row.tunnel_expires_at && row.status !== "archived" && Date.parse(row.tunnel_expires_at) > Date.now() ? { tunnel: { url: row.tunnel_url, expiresAt: row.tunnel_expires_at } } : {}
   };
 }
 function runnerSessionRecord(row) {
@@ -580,6 +593,7 @@ function runnerSessionRecord(row) {
     nextScheduledAt: _nextScheduledAt,
     parentSessionId: _parentSessionId,
     packed: _packed,
+    tunnel: _tunnel,
     ...record4
   } = sessionRecord(row);
   return record4;
@@ -705,6 +719,7 @@ var NATIVE_CODE_TTL = 2 * 60 * 1e3;
 var OPAQUE_TOKEN = /^[A-Za-z0-9_-]{43}$/;
 var CALLBACK_PATH = "/api/auth/github/callback";
 var NATIVE_CALLBACK = "pikibun://auth";
+var NATIVE_PAGE_PATH = "/api/auth/native/done";
 var VERIFIER = /^[A-Za-z0-9_-]{43,128}$/;
 var APP_STATE = /^[A-Za-z0-9_-]{16,128}$/;
 var PROFILE_FIELDS = { displayName: true, gitName: true, gitEmail: true, env: true };
@@ -947,8 +962,18 @@ async function githubAuthorization(c, native, inviteTokenHash) {
   const state = randomToken();
   const verifier = randomToken();
   const expiresAt2 = Date.now() + STATE_TTL;
-  await dbResult(c.env.DB.query(`INSERT INTO oauth_states (state_hash, verifier, expires_at, created_at, native_challenge, native_state, invite_token_hash)
-    VALUES (?, ?, ?, ?, ?, ?, ?)`).bind(await sha256(state), verifier, expiresAt2, now(), native?.challenge ?? null, native?.state ?? null, inviteTokenHash ?? null).run());
+  await dbResult(c.env.DB.query(`INSERT INTO oauth_states
+    (state_hash, verifier, expires_at, created_at, native_challenge, native_state, native_callback, invite_token_hash)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).bind(
+    await sha256(state),
+    verifier,
+    expiresAt2,
+    now(),
+    native?.challenge ?? null,
+    native?.state ?? null,
+    native?.callback === "page" ? "page" : null,
+    inviteTokenHash ?? null
+  ).run());
   const cookieConfig = cookies(c.env);
   setCookie(c, cookieConfig.state, state, { ...cookieConfig.options, maxAge: STATE_TTL / 1e3, expires: new Date(expiresAt2) });
   const authorization2 = new URL("https://github.com/login/oauth/authorize");
@@ -996,18 +1021,24 @@ async function githubSignup(c, githubId, inviteTokenHash, native) {
 function nativeStart(c) {
   const challenges = c.req.queries("challenge");
   const states = c.req.queries("state");
+  const callbacks = c.req.queries("callback");
   const challenge = challenges?.length === 1 ? challenges[0] : void 0;
   const state = states?.length === 1 ? states[0] : void 0;
   if (!challenge || !OPAQUE_TOKEN.test(challenge) || !state || !APP_STATE.test(state)) fail(400, "invalid_native_request", "Invalid native sign-in request.");
-  return githubStart(c, { challenge, state });
+  if (callbacks !== void 0 && (callbacks.length !== 1 || callbacks[0] !== "page")) fail(400, "invalid_native_request", "Invalid native sign-in request.");
+  return githubStart(c, { challenge, state, callback: callbacks ? "page" : "scheme" });
 }
-function nativeCallback(params) {
-  return `${NATIVE_CALLBACK}?${new URLSearchParams(params).toString()}`;
+function nativeCallback(c, native, params) {
+  const query = new URLSearchParams({ ...params, state: native.state }).toString();
+  return native.callback === "page" ? `${appOrigin(c.env)}${NATIVE_PAGE_PATH}?${query}` : `${NATIVE_CALLBACK}?${query}`;
 }
-async function nativeFailure(c, error, state) {
+async function nativeFailure(c, error, native) {
   if (!(error instanceof HTTPException2)) throw error;
   const body = await error.getResponse().json().catch(() => null);
-  return c.redirect(nativeCallback({ error: typeof body?.code === "string" ? body.code : "sign_in_failed", state }));
+  return c.redirect(nativeCallback(c, native, { error: typeof body?.code === "string" ? body.code : "sign_in_failed" }));
+}
+function nativeDone(c) {
+  return c.html('<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Pikibun</title><p style="font:16px system-ui,sans-serif;text-align:center;margin-top:30vh">You can return to Pikibun.</p>');
 }
 async function githubUser(c, config, code, verifier, inviteTokenHash = null, native = false) {
   const exchange = await githubJson("https://github.com/login/oauth/access_token", {
@@ -1118,13 +1149,13 @@ async function githubCallback(c) {
     fail(400, "invalid_oauth_state", "Invalid or expired OAuth state.");
   }
   const saved = await dbResult(c.env.DB.query(
-    "DELETE FROM oauth_states WHERE state_hash = ? RETURNING verifier, expires_at, native_challenge, native_state, invite_token_hash"
+    "DELETE FROM oauth_states WHERE state_hash = ? RETURNING verifier, expires_at, native_challenge, native_state, native_callback, invite_token_hash"
   ).bind(await sha256(state)).first());
   expireCookie(c, "state");
   if (!saved || !Number.isSafeInteger(saved.expires_at) || saved.expires_at <= Date.now() || !OPAQUE_TOKEN.test(saved.verifier)) {
     fail(400, "invalid_oauth_state", "Invalid or expired OAuth state.");
   }
-  const native = saved.native_challenge !== null && saved.native_state !== null ? { challenge: saved.native_challenge, state: saved.native_state } : void 0;
+  const native = saved.native_challenge !== null && saved.native_state !== null ? { challenge: saved.native_challenge, state: saved.native_state, callback: saved.native_callback === "page" ? "page" : "scheme" } : void 0;
   let signedIn;
   try {
     const codes = c.req.queries("code");
@@ -1135,9 +1166,9 @@ async function githubCallback(c) {
     signedIn = await githubUser(c, config, code, saved.verifier, saved.invite_token_hash, !!native);
   } catch (error) {
     if (error instanceof SignupRefusal) {
-      return c.redirect(native ? nativeCallback({ error: error.code, state: native.state }) : `${appOrigin(c.env)}/?${new URLSearchParams({ error: error.message }).toString()}`);
+      return c.redirect(native ? nativeCallback(c, native, { error: error.code }) : `${appOrigin(c.env)}/?${new URLSearchParams({ error: error.message }).toString()}`);
     }
-    if (native) return nativeFailure(c, error, native.state);
+    if (native) return nativeFailure(c, error, native);
     throw error;
   }
   const { user, tokenStatement } = signedIn;
@@ -1151,9 +1182,9 @@ async function githubCallback(c) {
         c.env.DB.query("INSERT INTO native_auth_codes (code_hash, user_id, challenge, expires_at, created_at) VALUES (?, ?, ?, ?, ?)").bind(await sha256(code), user.id, native.challenge, Date.now() + NATIVE_CODE_TTL, now())
       ]));
     } catch (error) {
-      return nativeFailure(c, error, native.state);
+      return nativeFailure(c, error, native);
     }
-    return c.redirect(nativeCallback({ code, state: native.state }));
+    return c.redirect(nativeCallback(c, native, { code }));
   }
   const session = await newSession(c.env, user.id, "github");
   await dbResult(c.env.DB.batch([tokenStatement, session.statement]));
@@ -1232,6 +1263,7 @@ function registerAuth(app2) {
   app2.get(CALLBACK_PATH, privateResponse, githubCallback);
   app2.get("/api/auth/local/claim", privateResponse, localClaim);
   app2.get("/api/auth/native/start", privateResponse, nativeStart);
+  app2.get(NATIVE_PAGE_PATH, privateResponse, nativeDone);
   app2.post("/api/auth/native/token", privateResponse, nativeToken);
   app2.post("/api/auth/test", privateResponse, csrfGuard, testLogin);
   app2.get("/api/auth/csrf", privateResponse, authenticate, (c) => c.json({ csrfToken: c.get("auth").csrfToken }));
@@ -1887,7 +1919,8 @@ var actionPermissions = {
   pack: "manage",
   unpack: "manage",
   withdraw: "ask",
-  upload: "write"
+  upload: "write",
+  tunnel: "write"
 };
 var connectorPermissions = {
   create: "write",
@@ -1907,7 +1940,8 @@ var connectorPermissions = {
   pack: "manage",
   unpack: "manage",
   withdraw: "ask",
-  upload: "write"
+  upload: "write",
+  tunnel: "write"
 };
 var ownerActions = ["create", "restart", "restore", "backup", "fork", "pack", "unpack"];
 function requireArchivedAction(row, action) {
@@ -2056,6 +2090,8 @@ async function authorizeSession(c, connectorId) {
 }
 
 // ../../apps/server/src/authority/operations.ts
+var programTools = /* @__PURE__ */ new Set([...programToolNames, ...bundledToolDefinitions.filter((item2) => item2.kind === "program").map((item2) => item2.name)]);
+var knownTools = /* @__PURE__ */ new Set([...toolNames, ...bundledToolDefinitions.map((item2) => item2.name)]);
 function validRepositoryPath(value) {
   return typeof value === "string" && value.length <= 512 && /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+){1,63}$/.test(value) && !value.split("/").some((part) => [".", "..", ".git"].includes(part.toLowerCase()));
 }
@@ -2096,7 +2132,7 @@ function parseOperation(input2) {
     case "bash":
       return { kind: value.kind, command: text(value.command, "command", 8192) };
     case "program":
-      if (Object.keys(value).length !== 3 || !programToolNames.includes(value.tool)) fail(400, "invalid_operation", "Unknown program tool.");
+      if (Object.keys(value).length !== 3 || typeof value.tool !== "string" || !programTools.has(value.tool)) fail(400, "invalid_operation", "Unknown program tool.");
       return { kind: value.kind, tool: value.tool, command: text(value.command, "command", 8192) };
     case "github.comment":
       return { kind: value.kind, repository: githubRepositoryName(value.repository), issue: issueNumber(value.issue), body: text(value.body, "comment body", 6e4) };
@@ -2132,7 +2168,7 @@ function parseOperation(input2) {
     }
     case "permission": {
       const needs = value.needs;
-      if (!toolNames.includes(value.tool)) fail(400, "invalid_operation", "Unknown tool.");
+      if (typeof value.tool !== "string" || !knownTools.has(value.tool)) fail(400, "invalid_operation", "Unknown tool.");
       if (!Array.isArray(needs) || !needs.length || needs.join() !== permissionNeeds.filter((need) => needs.includes(need)).join()) {
         fail(400, "invalid_operation", "Invalid permission needs.");
       }
@@ -4862,6 +4898,9 @@ async function sourceRead(c, connectorId) {
     await requireToolCall(c.env, access.row, "source_read", { id: callId, requestedBy: actorId, admission, target: item2 === null ? sourceId : `${sourceId}: ${item2}` });
     const source2 = await c.env.DB.query(`${documentSourceSelect} WHERE d.source_id = ? AND d.workspace_id = ?`).bind(sourceId, access.row.workspace_id).first();
     if (!source2) fail(404, "source_not_found", "This workspace has no such source, or it is a repository (clone those with Git).");
+    if (documentKindsOff(await workspaceExtensions(c.env, access.row.workspace_id)).has(source2.kind)) {
+      fail(403, "source_kind_off", `Reading ${documentKindNames[source2.kind]} sources is turned off in this workspace (${documentSourceExtensionOf(source2.kind)?.source ?? "its extension"}). Its owners and admins turn it on under Settings \u2192 Workspaces \u2192 Extensions.`);
+    }
     return { row: access.row, source: source2 };
   };
   const { row, source } = await authorize();
@@ -8414,6 +8453,7 @@ function connectorPath(action, sessionId, suffix = "") {
     case "unpack":
     case "withdraw":
     case "upload":
+    case "tunnel":
       return `${base}/${action}`;
     default:
       return fail(400, "invalid_action", "Invalid connector action.");
@@ -9370,7 +9410,8 @@ var stringVars = [
   "TENCENT_DOCS_CLIENT_ID",
   "TENCENT_DOCS_CLIENT_SECRET",
   "WEB_PUSH_CONTACT",
-  "EXPO_ACCESS_TOKEN"
+  "EXPO_ACCESS_TOKEN",
+  "PIKIBUN_VERSION"
 ];
 var LOOPBACK = ["127.0.0.1", "::1", "localhost"];
 async function loadConfig(processEnv = process.env) {
@@ -9509,7 +9550,8 @@ async function actorRequest(c, actorId, row, action, suffix = "", body, pin) {
     pack: `/v1/sessions/${row.id}/pack`,
     unpack: `/v1/sessions/${row.id}/unpack`,
     withdraw: `/v1/sessions/${row.id}/withdraw`,
-    upload: `/v1/sessions/${row.id}/upload`
+    upload: `/v1/sessions/${row.id}/upload`,
+    tunnel: `/v1/sessions/${row.id}/tunnel`
   };
   const serialized = body === void 0 ? "" : JSON.stringify(body);
   const issuedAt = Math.floor(Date.now() / 1e3);
@@ -10061,8 +10103,8 @@ function redactEntry(entry2) {
 // ../../apps/server/src/host-config.ts
 async function connectorHostConfig(env, connectorId) {
   const row = await env.DB.query(`SELECT command_timeout_seconds, gpu, git_credentials, repository_cache, host_sessions, compaction_json,
-    builtin_extensions_json, required_extensions_json, browser_json FROM connector_configs WHERE connector_id = ?`).bind(connectorId).first();
-  if (!row) return { ...defaultHostConfig, builtinExtensions: [], requiredExtensions: [], browser: { ...defaultHostBrowserConfig } };
+    builtin_extensions_json, required_extensions_json, browser_json, service_lifetime_seconds, tunnel_json FROM connector_configs WHERE connector_id = ?`).bind(connectorId).first();
+  if (!row) return { ...defaultHostConfig, builtinExtensions: [], requiredExtensions: [], browser: { ...defaultHostBrowserConfig }, tunnel: { ...defaultHostTunnelConfig } };
   return {
     commandTimeoutSeconds: Number(row.command_timeout_seconds),
     gpu: Number(row.gpu) === 1,
@@ -10072,9 +10114,23 @@ async function connectorHostConfig(env, connectorId) {
     compaction: storedCompaction(row.compaction_json),
     builtinExtensions: storedBuiltinExtensions(row.builtin_extensions_json),
     requiredExtensions: storedRequiredExtensions(row.required_extensions_json),
-    browser: storedBrowser(row.browser_json)
+    browser: storedBrowser(row.browser_json),
+    serviceLifetimeSeconds: storedLifetime(row.service_lifetime_seconds),
+    tunnel: storedTunnel(row.tunnel_json)
   };
 }
+function storedLifetime(value) {
+  const seconds = Number(value);
+  const { min, max } = hostConfigLimits.serviceLifetimeSeconds;
+  return Number.isSafeInteger(seconds) && seconds >= min && seconds <= max ? seconds : defaultHostConfig.serviceLifetimeSeconds;
+}
+function storedTunnel(json2) {
+  try {
+    return parseHostTunnelConfig(JSON.parse(json2));
+  } catch {
+    return { ...defaultHostTunnelConfig };
+  }
+}
 function storedBrowser(json2) {
   try {
     return parseHostBrowserConfig(JSON.parse(json2));
@@ -10122,12 +10178,14 @@ var columns = Object.freeze({
   compaction: "compaction_json",
   builtinExtensions: "builtin_extensions_json",
   requiredExtensions: "required_extensions_json",
-  browser: "browser_json"
+  browser: "browser_json",
+  serviceLifetimeSeconds: "service_lifetime_seconds",
+  tunnel: "tunnel_json"
 });
 function upsert(settings) {
   return `INSERT INTO connector_configs (connector_id, command_timeout_seconds, gpu, git_credentials, repository_cache, host_sessions, compaction_json,
-    builtin_extensions_json, required_extensions_json, browser_json, updated_by, updated_at)
-  SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM connectors WHERE id = ? AND revoked_at IS NULL AND removed_at IS NULL)
+    builtin_extensions_json, required_extensions_json, browser_json, service_lifetime_seconds, tunnel_json, updated_by, updated_at)
+  SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM connectors WHERE id = ? AND revoked_at IS NULL AND removed_at IS NULL)
   ON CONFLICT (connector_id) DO UPDATE SET ${settings.map((key) => `${columns[key]} = excluded.${columns[key]}, `).join("")}
     updated_by = excluded.updated_by, updated_at = excluded.updated_at
   RETURNING connector_id`;
@@ -10151,7 +10209,7 @@ function registerHostConfig(app2) {
     let settings = Object.keys(change);
     if (row.role !== "owner") {
       if (settings.some((key) => ownerOnlyHostConfig.includes(key) && JSON.stringify(change[key]) !== JSON.stringify(current[key]))) {
-        fail(403, "host_owner_required", "Only the host's owner decides whether it uses its Git credentials, keeps a repository cache, runs sessions without the sandbox, requires extensions of every session on it or where its browser comes from.");
+        fail(403, "host_owner_required", "Only the host's owner decides whether it uses its Git credentials, keeps a repository cache, runs sessions without the sandbox, requires extensions of every session on it, where its browser comes from or whether its sessions may put servers online through tunnels.");
       }
       settings = settings.filter((key) => !ownerOnlyHostConfig.includes(key));
       if (!settings.length) return c.json({ config: current });
@@ -10168,6 +10226,8 @@ function registerHostConfig(app2) {
       JSON.stringify(config.builtinExtensions),
       JSON.stringify(config.requiredExtensions),
       JSON.stringify(config.browser),
+      config.serviceLifetimeSeconds,
+      JSON.stringify(config.tunnel),
       actorId,
       now(),
       row.id
@@ -10388,6 +10448,7 @@ async function versionBatch(env, statements, versionIndex) {
     throw error;
   }
 }
+var agentToolNames = [...toolNames, ...bundledToolDefinitions.map((item2) => item2.name).filter((name2) => !toolNames.includes(name2))];
 function carries(capabilities, tool) {
   if (retiredToolNames.includes(tool)) return false;
   if (tool === "git_push") return capabilities.gitPush === true;
@@ -10401,7 +10462,7 @@ function carries(capabilities, tool) {
 async function chatAgentVersion(env, ownerId, model, capabilities) {
   const agentId = id();
   const createdAt = now();
-  const tools = toolNames.filter((tool) => carries(capabilities, tool));
+  const tools = agentToolNames.filter((tool) => carries(capabilities, tool));
   const input2 = { name: model.name, description: "", instructions: "", toolsJson: JSON.stringify(tools), modelId: model.id };
   return versionBatch(env, [
     env.DB.query(`INSERT INTO agents (id, author_id, created_at, chat)
@@ -10415,7 +10476,7 @@ async function migratedAgentVersion(env, ownerId, source, model, capabilities) {
   const agentId = id();
   const createdAt = now();
   const wanted = JSON.parse(source.tools_json);
-  const tools = toolNames.filter((tool) => wanted.includes(tool) && carries(capabilities, tool));
+  const tools = agentToolNames.filter((tool) => wanted.includes(tool) && carries(capabilities, tool));
   const input2 = {
     name: source.name,
     description: source.description,
@@ -10980,6 +11041,40 @@ function redactedEntry(entry2) {
   return shown;
 }
 
+// ../../apps/server/src/session-tunnels.ts
+async function reportSessionTunnel(c, connectorId) {
+  let report;
+  try {
+    report = parseSessionTunnelReport(await jsonObject(c, 4096));
+  } catch (error) {
+    return fail(400, "invalid_tunnel", error instanceof Error ? error.message : "Invalid tunnel report.");
+  }
+  const row = await c.env.DB.query("SELECT * FROM sessions WHERE id = ?").bind(report.sessionId).first();
+  if (!row) fail(404, "not_found", "Session not found.");
+  await requireCallbackScope(c, row, connectorId);
+  const actor = report.actorId && await c.env.DB.query("SELECT 1 FROM workspace_members WHERE workspace_id = ? AND user_id = ?").bind(row.workspace_id, report.actorId).first() ? report.actorId : null;
+  const detail = { connectorId, url: report.url, ...report.expiresAt ? { expiresAt: report.expiresAt } : {}, ...report.reason ? { reason: report.reason } : {} };
+  await c.env.DB.batch([
+    report.event === "started" ? c.env.DB.query("UPDATE sessions SET tunnel_url = ?, tunnel_expires_at = ? WHERE id = ? AND connector_id = ? AND status <> 'archived'").bind(report.url, report.expiresAt, row.id, connectorId) : c.env.DB.query("UPDATE sessions SET tunnel_url = NULL, tunnel_expires_at = NULL WHERE id = ? AND connector_id = ? AND tunnel_url = ?").bind(row.id, connectorId, report.url),
+    auditStatement(c.env, actor, `session.tunnel.${report.event}`, row.workspace_id, row.id, detail)
+  ]);
+  invalidateSessionView(c, row.id);
+  return c.json({ ok: true });
+}
+async function stopSessionTunnel(c, row, reason) {
+  const result3 = await runnerJSON(await runnerRequest(c, row, "tunnel", "", { action: "stop", ...reason ? { reason } : {} }));
+  invalidateSessionView(c, row.id);
+  if (typeof result3?.stopped !== "boolean") fail(502, "invalid_runner_response", "The runner returned an invalid tunnel result.");
+  return result3.stopped;
+}
+function registerSessionTunnels(app2) {
+  app2.post("/api/sessions/:id/tunnel/stop", async (c) => {
+    const { row } = await requireSession(c, identifier(c.req.param("id")), "write");
+    if (!row.connector_id) fail(409, "tunnel_unsupported", "Only sessions on a connected host put servers online.");
+    return c.json({ stopped: await stopSessionTunnel(c, row) });
+  });
+}
+
 // ../../apps/server/src/transcript-settings.ts
 var adminSql6 = `EXISTS (SELECT 1 FROM workspace_members WHERE workspace_id = ? AND user_id = ? AND role IN ('owner','admin'))`;
 function settingsOf2(row) {
@@ -11358,7 +11453,9 @@ async function archiveSession(c, sessionId, audit = {}) {
   const access = await requireSessionManager(c, sessionId, "manage", "Only the session owner, or the workspace's owner or an admin, can archive it.");
   const { row } = access;
   const actorId = c.get("auth").userId;
-  const archived = await c.env.DB.query(`UPDATE sessions SET archived_status = status, status = 'archived', policy_version = policy_version + 1
+  if (row.tunnel_url && row.connector_id) await stopSessionTunnel(c, row, "archived").catch(() => false);
+  const archived = await c.env.DB.query(`UPDATE sessions SET archived_status = status, status = 'archived', policy_version = policy_version + 1,
+    tunnel_url = NULL, tunnel_expires_at = NULL
     WHERE id = ? AND owner_id = ? AND policy_version = ? AND status <> 'archived' AND ${sessionManagerSQL("sessions")}
     RETURNING *`).bind(row.id, row.owner_id, row.policy_version, actorId).first();
   if (!archived) fail(409, "policy_changed", "Session status or permissions changed; reload and retry.");
@@ -14335,6 +14432,7 @@ async function connectorInfo(env, row, viewer) {
     revokedAt: row.revoked_at,
     online,
     models,
+    ...row.connector_version ? { version: row.connector_version } : {},
     workspaceIds: workspaceIds.filter(visible),
     connectedWorkspaceIds: connectedWorkspaceIds.filter(visible),
     capabilities,
@@ -14444,8 +14542,9 @@ function registerConnectorCredentials(app2) {
     const input2 = await jsonObject(c, 128 * 1024);
     onlyFields2(input2, ["models", "capabilities"]);
     const manifest = withHostToolCapabilities(input2, (base) => parseManifest(base, c.env));
-    const updated = await c.env.DB.query(`UPDATE connectors SET models_json = ?, capabilities_json = ? WHERE id = ?
-      AND revoked_at IS NULL AND connection_hash = ? RETURNING *`).bind(JSON.stringify(manifest.models), JSON.stringify(manifest.capabilities), row.id, row.connection_hash).first();
+    const version = validVersion(c.req.header(CONNECTOR_VERSION_HEADER)) ?? null;
+    const updated = await c.env.DB.query(`UPDATE connectors SET models_json = ?, capabilities_json = ?, connector_version = ? WHERE id = ?
+      AND revoked_at IS NULL AND connection_hash = ? RETURNING *`).bind(JSON.stringify(manifest.models), JSON.stringify(manifest.capabilities), version, row.id, row.connection_hash).first();
     if (!updated) fail(401, "stale_connection", "Connection has been replaced.");
     await syncModels(c.env, updated, null);
     return c.json({ ok: true });
@@ -14453,11 +14552,16 @@ function registerConnectorCredentials(app2) {
   app2.post("/api/connectors/self/authorize", async (c) => authorizeSession(c, (await authenticateConnector(c)).id));
   app2.post("/api/connectors/self/activity", async (c) => reportSessionActivity(c, (await authenticateConnector(c)).id));
   app2.post("/api/connectors/self/branches", async (c) => reportSessionBranches(c, (await authenticateConnector(c)).id));
+  app2.post("/api/connectors/self/tunnel", async (c) => reportSessionTunnel(c, (await authenticateConnector(c)).id));
   app2.post("/api/connectors/self/github/comment", async (c) => githubComment(c, (await authenticateConnector(c)).id));
   app2.post("/api/connectors/self/github/read", async (c) => githubRead(c, (await authenticateConnector(c)).id));
   app2.post("/api/connectors/self/github/merge", async (c) => githubMerge(c, (await authenticateConnector(c)).id));
   app2.post("/api/connectors/self/github/issue", async (c) => githubIssue(c, (await authenticateConnector(c)).id));
   app2.post("/api/connectors/self/sources/read", async (c) => sourceRead(c, (await authenticateConnector(c)).id));
+  app2.post("/api/connectors/self/tools", async (c) => {
+    await authenticateConnector(c);
+    return c.json({ tools: bundledToolDefinitions });
+  });
   app2.post("/api/connectors/self/schedules", async (c) => agentSchedules(c, (await authenticateConnector(c)).id));
   app2.post("/api/connectors/self/sessions", async (c) => agentSessions(c, (await authenticateConnector(c)).id));
   app2.post("/api/connectors/self/web/search", async (c) => {
@@ -14592,7 +14696,7 @@ function registerConnectors(app2) {
     const timestamp2 = now();
     await c.env.DB.batch([
       c.env.DB.query(`UPDATE connectors SET removed_at = ?, revoked_at = COALESCE(revoked_at, ?),
-        connection_hash = NULL, credential_hash = ?, name = 'Removed host', models_json = '[]', capabilities_json = '{}'
+        connection_hash = NULL, credential_hash = ?, name = 'Removed host', models_json = '[]', capabilities_json = '{}', connector_version = NULL
         WHERE id = ?`).bind(timestamp2, timestamp2, await sha256(randomToken()), row.id),
       c.env.DB.query("DELETE FROM connector_shares WHERE connector_id = ?").bind(row.id),
       c.env.DB.query("DELETE FROM connector_workspaces WHERE connector_id = ?").bind(row.id),
@@ -14929,14 +15033,31 @@ function availability(extensions, installed) {
 function shownReport(report, ownerView) {
   if (ownerView) return report;
   const browser = report.browser && (({ executable: _, error: __, ...rest }) => rest)(report.browser);
-  return { ...report, installed: report.installed.filter((item2) => !item2.dev), ...browser ? { browser } : {} };
+  const tunnel = report.tunnel && (({ executable: _, error: __, ...rest }) => rest)(report.tunnel);
+  return { ...report, installed: report.installed.filter((item2) => !item2.dev), ...browser ? { browser } : {}, ...tunnel ? { tunnel } : {} };
 }
 var coreSources = pikiSessionToolExtensions().filter((item2) => item2.core).map((item2) => item2.source);
 var adminSql8 = `EXISTS (SELECT 1 FROM workspace_members WHERE workspace_id = ? AND user_id = ? AND role IN ('owner','admin'))`;
-function connectorWorkspaceExtensions(extensions, installed) {
+function connectorWorkspaceExtensions(extensions, installed, options = {}) {
   const has = new Set((installed ?? []).map((item2) => item2.source));
   const knowsPiki = [...has].some(isPikiExtensionSource);
-  return extensions.filter((item2) => !isPikiExtensionSource(item2.source) || knowsPiki && (!sessionToolSources.includes(item2.source) || has.has(item2.source)));
+  if (options.toolDefinitions && knowsPiki) for (const definition of bundledToolDefinitions) for (const extension of definition.extensions) has.add(extension);
+  const shown = extensions.filter((item2) => !isPikiExtensionSource(item2.source) || knowsPiki && (!sessionToolSources.includes(item2.source) || has.has(item2.source)));
+  return knowsPiki ? withReplacedSwitches(shown, extensions, has) : shown;
+}
+function withReplacedSwitches(shown, extensions, has) {
+  let result3 = [...shown];
+  const replaced = new Set(pikiExtensions.flatMap((item2) => item2.replaces ? [item2.replaces] : []));
+  for (const source of replaced) {
+    const successors = pikiExtensions.filter((item2) => item2.replaces === source);
+    if (!has.has(source) || successors.some((item2) => has.has(item2.source))) continue;
+    const on = successors.some((item2) => pikiExtensionOn(item2, extensions));
+    const own = result3.find((item2) => item2.source === source);
+    if (on) result3 = result3.filter((item2) => item2.source !== source);
+    else if (own) result3 = result3.map((item2) => item2.source === source ? { ...item2, enabled: false } : item2);
+    else result3.push({ source, enabled: false, tools: "approval", settings: {} });
+  }
+  return result3;
 }
 function registerConnectorExtensions(app2) {
   app2.post("/api/connectors/self/extensions", async (c) => {
@@ -14977,12 +15098,13 @@ function registerConnectorExtensions(app2) {
     const row = await authenticateConnector(c);
     const input2 = await jsonObject(c, 4096);
     const workspaceId = identifier(input2.workspaceId, "workspaceId");
+    const options = { toolDefinitions: input2.toolDefinitions === true };
     const connected = await c.env.DB.query(`SELECT cw.connector_id FROM connector_workspaces cw
       JOIN workspace_members m ON m.workspace_id = cw.workspace_id AND m.user_id = ?
       WHERE cw.connector_id = ? AND cw.workspace_id = ?`).bind(row.owner_id, row.id, workspaceId).first();
     if (!connected) fail(404, "not_found", "Workspace not found.");
     const extensions = await workspaceExtensions(c.env, workspaceId);
-    const shown = extensions.some((item2) => isPikiExtensionSource(item2.source)) ? connectorWorkspaceExtensions(extensions, (await hostReport(c.env, row.id))?.report.installed) : extensions;
+    const shown = extensions.some((item2) => isPikiExtensionSource(item2.source)) ? connectorWorkspaceExtensions(extensions, (await hostReport(c.env, row.id))?.report.installed, options) : extensions;
     return c.json({ extensions: shown, automaticTools: await automaticTools(c.env, row.id) });
   });
 }
@@ -16002,6 +16124,8 @@ app.get("/api/health", async (c) => {
   }
   return c.json({
     ok: true,
+    // The release it runs, such as 0.24.0; null in development. Shown in the web app's settings.
+    version: validVersion(c.env.PIKIBUN_VERSION) ?? buildVersion ?? null,
     githubConfigured: !!c.env.GITHUB_CLIENT_ID && !!c.env.GITHUB_CLIENT_SECRET && vaultReady,
     runnerConfigured: !!c.env.RUNNER_URL && !!c.env.RUNNER_SHARED_SECRET && c.env.RUNNER_SHARED_SECRET.length >= 32,
     databaseConfigured: true,
@@ -16045,6 +16169,7 @@ registerSessions(app);
 registerSessionLinks(app);
 registerBackups(app);
 registerSessionFiles(app);
+registerSessionTunnels(app);
 registerFileUploads(app);
 registerScheduledPrompts(app);
 registerCrossSession(app);
@@ -16062,7 +16187,7 @@ app.all("/api/*", () => fail(404, "not_found", "API route not found."));
 
 // ../../apps/server/src/static.ts
 import { createReadStream } from "node:fs";
-import { stat } from "node:fs/promises";
+import { readFile as readFile3, stat } from "node:fs/promises";
 import { extname, join as join2, resolve as resolve3, sep as sep2 } from "node:path";
 import { Readable } from "node:stream";
 var contentTypes = {
@@ -16070,9 +16195,11 @@ var contentTypes = {
   ".js": "text/javascript; charset=utf-8",
   ".mjs": "text/javascript; charset=utf-8",
   ".css": "text/css; charset=utf-8",
+  ".wasm": "application/wasm",
   ".json": "application/json; charset=utf-8",
   ".webmanifest": "application/manifest+json",
   ".map": "application/json",
+  ".bin": "application/octet-stream",
   ".svg": "image/svg+xml",
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -16083,12 +16210,30 @@ var contentTypes = {
   ".woff": "font/woff",
   ".woff2": "font/woff2",
   ".ttf": "font/ttf",
+  ".otf": "font/otf",
   ".txt": "text/plain; charset=utf-8"
 };
+var hashedName = /\.[0-9a-f]{10}\.[a-z0-9]+$/;
+function pageContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self' blob: 'unsafe-inline' 'wasm-unsafe-eval'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob: https://avatars.githubusercontent.com",
+    "font-src 'self' data:",
+    // The runtime reads its own blobs (a pasted image, a picked photo) with fetch.
+    "connect-src 'self' blob: data:",
+    "worker-src 'self' blob:",
+    "object-src 'none'",
+    "base-uri 'self'",
+    "frame-ancestors 'none'",
+    "form-action 'self'"
+  ].join("; ");
+}
 function createStaticHandler(root) {
   const base = resolve3(root);
   const index = join2(base, "index.html");
-  async function serve(path2, request2, cacheControl) {
+  async function file2(path2, request2) {
     let info2;
     try {
       info2 = await stat(path2);
@@ -16100,11 +16245,24 @@ function createStaticHandler(root) {
       "Content-Type": contentTypes[extname(path2).toLowerCase()] ?? "application/octet-stream",
       "Content-Length": String(info2.size),
       "Last-Modified": info2.mtime.toUTCString(),
-      "Cache-Control": cacheControl
+      "Cache-Control": hashedName.test(path2) ? "public, max-age=31536000, immutable" : "no-cache"
     };
     if (request2.method === "HEAD") return new Response(null, { status: 200, headers: headers3 });
     return new Response(Readable.toWeb(createReadStream(path2)), { status: 200, headers: headers3 });
   }
+  async function page(request2) {
+    let html;
+    try {
+      html = await readFile3(index, "utf8");
+    } catch {
+      return Response.json({ error: "The web app is not built: run `pnpm build`.", code: "not_found" }, { status: 404 });
+    }
+    if (!/<base\s/i.test(html)) html = html.replace(/<head>/i, '<head>\n<base href="/">');
+    return new Response(request2.method === "HEAD" ? null : html, {
+      status: 200,
+      headers: { "Content-Type": contentTypes[".html"], "Cache-Control": "no-cache", "Content-Security-Policy": pageContentSecurityPolicy() }
+    });
+  }
   return async (request2) => {
     let pathname;
     try {
@@ -16114,12 +16272,12 @@ function createStaticHandler(root) {
     }
     if (!pathname.includes("\0") && pathname !== "/") {
       const path2 = resolve3(base, `.${pathname}`);
-      if (path2.startsWith(base + sep2)) {
-        const response = await serve(path2, request2, pathname.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "no-cache");
+      if (path2.startsWith(base + sep2) && path2 !== index) {
+        const response = await file2(path2, request2);
         if (response) return response;
       }
     }
-    return await serve(index, request2, "no-cache") ?? Response.json({ error: "Not found.", code: "not_found" }, { status: 404 });
+    return page(request2);
   };
 }
 
@@ -16184,8 +16342,11 @@ async function startServer(config) {
     if (c.req.method !== "GET" && c.req.method !== "HEAD" || c.req.path.startsWith("/api/")) {
       return c.json({ error: "Not found.", code: "not_found" }, 404);
     }
-    const response = await serveStatic(c.req.raw);
-    return c.newResponse(response.body, response);
+    const served = await serveStatic(c.req.raw);
+    const response = c.newResponse(served.body, served);
+    const policy = served.headers.get("Content-Security-Policy");
+    if (policy) response.headers.set("Content-Security-Policy", policy);
+    return response;
   });
   const server = createAdaptorServer({
     overrideGlobalObjects: false,
@@ -16435,7 +16596,7 @@ function defaultStaticDir() {
   let directory = dirname3(fileURLToPath(import.meta.url));
   for (let depth = 0; depth < 6; depth++) {
     for (const candidate of [join4(directory, "web"), join4(directory, "dist", "web")]) {
-      if (existsSync(join4(candidate, "index.html")) && existsSync(join4(candidate, "assets"))) return candidate;
+      if (existsSync(join4(candidate, "index.html")) && existsSync(join4(candidate, "manifest.webmanifest"))) return candidate;
     }
     directory = dirname3(directory);
   }