pikiloom 0.4.21 → 0.4.22

package/dist/cli/main.js

@@ -20,6 +20,7 @@ import { hasConfiguredChannelToken, resolveConfiguredChannels } from './channels
 import { ChannelSupervisor } from './channel-supervisor.js';
 import { listAgents } from '../agent/index.js';
 import { startDashboard } from '../dashboard/server.js';
+import { buildServerCode } from '../pikichannel/code.js';
 import { buildSetupGuide, collectSetupState, hasReadyAgent, isSetupReady } from './onboarding.js';
 import { buildRestartCommand, clearDaemonPidFile, clearRestartStateFile, consumeRestartStateFile, createRestartStateFilePath, isProcessAlive, PROCESS_RESTART_EXIT_CODE, readDaemonPidFile, requestProcessRestart, writeDaemonPidFile, } from '../core/process-control.js';
 import { runSetupWizard } from './setup-wizard.js';
@@ -185,6 +186,9 @@ function parseArgs(argv) {
             case '--no-dashboard':
                 args.noDashboard = true;
                 break;
+            case '--server':
+                args.server = true;
+                break;
             case '--dashboard-port':
                 args.dashboardPort = parseInt(it.next().value ?? '', 10);
                 break;
@@ -254,6 +258,7 @@ Options:
   --timeout <seconds>       Max seconds per agent request  [default: ${DEFAULT_RUN_TIMEOUT_S}]
   --doctor                  Run setup checks and exit
   --setup                   Run the interactive setup wizard
+  --server                  Headless server: keep the host running, don't open a browser, print a connection code
   --no-daemon               Disable watchdog (auto-restart on crash is ON by default)
   --no-dashboard            Skip the web dashboard
   --dashboard-port <port>   Dashboard port  [default: 3939]
@@ -521,13 +526,16 @@ async function runSetupPhase(args, userConfig, configOverrides, channels, channe
         // Suppress the browser pop on auto-start when there's no user-facing
         // terminal: launchd-spawned bots, Docker/headless server runs, or when
         // the user explicitly set PIKILOOM_OPEN_BROWSER=0.
-        const openBrowser = !process.env[FROM_LAUNCHD_ENV]
+        const openBrowser = !args.server
+            && !process.env[FROM_LAUNCHD_ENV]
             && !envBool('PIKILOOM_DOCKER', false)
             && envBool('PIKILOOM_OPEN_BROWSER', true);
         dashboard = await startDashboard({
             port: args.dashboardPort || 3939,
             open: openBrowser,
         });
+        if (args.server)
+            printServerConnectionCode(dashboard);
         if (needsSetup) {
             const ctx = { userConfig, configOverrides, args };
             const resolved = await awaitDashboardConfig(dashboard, ctx);
@@ -560,6 +568,28 @@ async function runSetupPhase(args, userConfig, configOverrides, channels, channe
     }
     return { dashboard, userConfig, channels, channel };
 }
+/** Print the shareable connection code for `--server` (headless) mode. */
+function printServerConnectionCode(dashboard) {
+    const c = loadUserConfig();
+    const sc = buildServerCode({
+        token: process.env.PIKICHANNEL_TOKEN || c.pikichannelToken,
+        nodeId: c.pikichannelNodeId,
+        publicHost: process.env.PIKICHANNEL_PUBLIC_HOST || c.pikichannelPublicHost,
+        rendezvous: process.env.PIKICHANNEL_RENDEZVOUS || c.pikichannelRendezvous,
+    });
+    const ts = new Date().toTimeString().slice(0, 8);
+    process.stdout.write(`\n[pikiloom ${ts}] server mode — host running, browser not opened\n`);
+    process.stdout.write(`  local console:  ${dashboard.url}\n`);
+    if (sc.mode === 'none') {
+        process.stdout.write('  to let others connect: set a public address (env PIKICHANNEL_PUBLIC_HOST,\n');
+        process.stdout.write('     or the dashboard 连接 → 分享 panel), or enable internet access, then restart.\n\n');
+    }
+    else {
+        process.stdout.write(`  connection code (${sc.mode === 'direct' ? 'direct → ' : 'NAT via '}${sc.detail}):\n`);
+        process.stdout.write(`    ${sc.code}\n`);
+        process.stdout.write('  paste it into a client → 连接 → 互联网/局域网.\n\n');
+    }
+}
 /* ── Phase: post-setup validation ─────────────────────────────────── */
 /**
  * Re-resolve channels after the setup phase and validate we have a runnable

package/dist/core/secrets/ref.js

@@ -10,6 +10,14 @@
  */
 /** Stable service name used when writing to the OS keychain. */
 export const KEYCHAIN_SERVICE = 'pikiloom';
+/**
+ * Legacy keychain service names this build still reads from. The project was
+ * renamed (pikiclaw → pikiloom); credentials written under the old service are
+ * orphaned because lookups now use `KEYCHAIN_SERVICE`. `readKeychain` falls
+ * back to these on a miss and lazily re-writes the secret under the current
+ * service, so each orphaned item self-heals on first use.
+ */
+export const LEGACY_KEYCHAIN_SERVICES = ['pikiclaw'];
 export function isCredentialRef(value) {
     if (!value || typeof value !== 'object')
         return false;

package/dist/core/secrets/store.js

@@ -2,7 +2,7 @@
  * OS keychain access — lazy import of @napi-rs/keyring (optional dep).
  * If keychain is unavailable, callers fall back to inline-seal.
  */
-import { KEYCHAIN_SERVICE } from './ref.js';
+import { KEYCHAIN_SERVICE, LEGACY_KEYCHAIN_SERVICES } from './ref.js';
 let keyringModule; // undefined = not tried, null = failed
 async function loadKeyring() {
     if (keyringModule !== undefined)
@@ -30,17 +30,37 @@ export async function readKeychain(account) {
     const mod = await loadKeyring();
     if (!mod)
         throw new Error('OS keychain unavailable (install @napi-rs/keyring)');
-    try {
-        const entry = new mod.Entry(KEYCHAIN_SERVICE, account);
-        const value = entry.getPassword();
-        return typeof value === 'string' && value.length > 0 ? value : null;
-    }
-    catch (e) {
-        // keyring-rs returns NoEntry as an error — treat as missing
-        if (/NoEntry|no.such|not.found/i.test(e?.message || ''))
-            return null;
-        throw e;
+    const readUnder = (service) => {
+        try {
+            const entry = new mod.Entry(service, account);
+            const value = entry.getPassword();
+            return typeof value === 'string' && value.length > 0 ? value : null;
+        }
+        catch (e) {
+            // keyring-rs returns NoEntry as an error — treat as missing
+            if (/NoEntry|no.such|not.found/i.test(e?.message || ''))
+                return null;
+            throw e;
+        }
+    };
+    const current = readUnder(KEYCHAIN_SERVICE);
+    if (current != null)
+        return current;
+    // Pre-rename fallback: recover orphaned items and migrate them forward so the
+    // legacy lookup only ever happens once per account.
+    for (const legacy of LEGACY_KEYCHAIN_SERVICES) {
+        const value = readUnder(legacy);
+        if (value == null)
+            continue;
+        try {
+            new mod.Entry(KEYCHAIN_SERVICE, account).setPassword(value);
+        }
+        catch {
+            // best-effort migration — return the recovered secret regardless
+        }
+        return value;
     }
+    return null;
 }
 export async function writeKeychain(account, value) {
     const mod = await loadKeyring();

package/dist/dashboard/routes/extensions.js

@@ -13,7 +13,7 @@
  */
 import { Hono } from 'hono';
 import { execFile } from 'node:child_process';
-import { addGlobalMcpExtension, removeGlobalMcpExtension, updateGlobalMcpExtension, addWorkspaceMcpExtension, removeWorkspaceMcpExtension, updateWorkspaceMcpExtension, getCatalogItems, buildInstalledConfigFromRecommended, checkMcpHealth, getCachedHealth, cacheHealth, getRecommendedMcpServer, listSkills, installSkill, removeSkill, getRecommendedSkillRepos, searchSkillRepos, searchMcpServers, startAuthorization, completeAuthorization, deleteMcpToken, getMcpToken, } from '../../agent/index.js';
+import { addGlobalMcpExtension, removeGlobalMcpExtension, updateGlobalMcpExtension, addWorkspaceMcpExtension, removeWorkspaceMcpExtension, updateWorkspaceMcpExtension, getCatalogItems, buildInstalledConfigFromRecommended, checkMcpHealth, getCachedHealth, cacheHealth, getRecommendedMcpServer, listSkills, installSkill, removeSkill, recordSkillInstall, getSkillLedgerEntry, getRecommendedSkillRepos, searchSkillRepos, searchMcpServers, startAuthorization, completeAuthorization, deleteMcpToken, getMcpToken, } from '../../agent/index.js';
 import { loadUserConfig, saveUserConfig } from '../../core/config/user-config.js';
 import { ensurePeekabooWarm } from '../../agent/mcp/bridge.js';
 import { runtime } from '../runtime.js';
@@ -582,6 +582,59 @@ async function fetchOneRepoMeta(source) {
         return null;
     }
 }
+/**
+ * Default-branch HEAD commit SHA per source — the signal we diff installed
+ * skills against. Cached with a much shorter TTL than the star/pushedAt meta
+ * (10 min vs 24h) so "update available" stays close to real-time without
+ * hammering the API; we only fetch it for collections that are actually
+ * installed. Cache only on success so a transient null never sticks.
+ */
+const repoHeadShaCache = new Map();
+const REPO_HEAD_SHA_TTL_MS = 10 * 60 * 1000;
+const repoHeadShaInflight = new Map();
+async function fetchRepoHeadSha(source) {
+    const parsed = parseSourceToOwnerRepo(source);
+    if (!parsed)
+        return null;
+    const slug = `${parsed.owner}/${parsed.repo}`;
+    const cached = repoHeadShaCache.get(slug);
+    if (cached && Date.now() - cached.cachedAt < REPO_HEAD_SHA_TTL_MS)
+        return cached.value;
+    const inflight = repoHeadShaInflight.get(slug);
+    if (inflight)
+        return inflight;
+    const promise = (async () => {
+        try {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 5_000);
+            const token = await resolveGithubToken();
+            // `commits?per_page=1` returns the latest commit on the default branch
+            // without needing to know the branch name first.
+            const res = await fetch(`https://api.github.com/repos/${slug}/commits?per_page=1`, {
+                signal: controller.signal,
+                headers: {
+                    'Accept': 'application/vnd.github+json',
+                    'User-Agent': 'pikiloom-dashboard',
+                    'X-GitHub-Api-Version': '2022-11-28',
+                    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+                },
+            });
+            clearTimeout(timer);
+            if (!res.ok)
+                return null;
+            const data = await res.json();
+            const sha = Array.isArray(data) && data[0]?.sha ? String(data[0].sha) : null;
+            if (sha)
+                repoHeadShaCache.set(slug, { value: sha, cachedAt: Date.now() });
+            return sha;
+        }
+        catch {
+            return null;
+        }
+    })().finally(() => repoHeadShaInflight.delete(slug));
+    repoHeadShaInflight.set(slug, promise);
+    return promise;
+}
 async function ensureRepoMeta(sources) {
     const now = Date.now();
     const stale = sources.filter(s => {
@@ -656,30 +709,56 @@ app.get('/api/extensions/skills/catalog', async (c) => {
     const installedByName = new Map();
     for (const s of scopedInstalled)
         installedByName.set(s.name.toLowerCase(), s);
-    const items = filtered.map(repo => {
-        const meta = githubMetaCache.get(repo.source)?.value;
+    // Resolve each repo's installed sub-skills first (sync). Prefer the remote
+    // listing intersection over the static `repo.skills` hint — most catalog
+    // entries don't fill the hint, and the GitHub listing is authoritative.
+    const computeInstalledNames = (repo) => {
         const remote = remoteSkillsCache.get(repo.source)?.value;
-        const owner = extractGithubOwner(repo.source);
-        const iconUrl = repo.iconUrl
-            ?? (owner ? `https://github.com/${owner}.png?size=80` : undefined);
-        // Prefer the remote-listing intersection over the static `repo.skills` hint
-        // — most catalog entries don't bother filling the hint, and the GitHub
-        // listing is authoritative when cached.
-        let installedSkillNames;
         if (remote) {
-            installedSkillNames = remote.skills
+            return remote.skills
                 .map(s => s.name)
                 .filter(name => installedByName.has(name.toLowerCase()));
         }
-        else {
-            const hints = (repo.skills || []).map(s => s.toLowerCase());
-            installedSkillNames = scopedInstalled
-                .filter(s => hints.includes(s.name.toLowerCase()))
-                .map(s => s.name);
+        const hints = (repo.skills || []).map(s => s.toLowerCase());
+        return scopedInstalled
+            .filter(s => hints.includes(s.name.toLowerCase()))
+            .map(s => s.name);
+    };
+    const perRepo = filtered.map(repo => ({ repo, installedNames: computeInstalledNames(repo) }));
+    // Update detection — only for installed collections (it's the only place the
+    // signal is meaningful, and it keeps API calls proportional to what's
+    // actually installed). Diff the live remote HEAD against the provenance
+    // ledger. For installs predating the ledger (e.g. via skills.sh) we baseline
+    // the current HEAD so future commits surface as updates, rather than
+    // fabricating one we can't prove.
+    const ledgerScope = scope === 'workspace' ? { workdir } : { global: true };
+    const updateBySource = new Map();
+    await Promise.all(perRepo.map(async ({ repo, installedNames }) => {
+        if (installedNames.length === 0)
+            return;
+        const latestSha = await fetchRepoHeadSha(repo.source).catch(() => null);
+        const entry = getSkillLedgerEntry(repo.source, ledgerScope);
+        let installedSha = entry?.sha ?? null;
+        if (!entry && latestSha) {
+            recordSkillInstall(repo.source, { ...ledgerScope, sha: latestSha, names: installedNames });
+            installedSha = latestSha;
         }
-        const firstMatch = installedSkillNames[0]
-            ? installedByName.get(installedSkillNames[0].toLowerCase())
+        updateBySource.set(repo.source, {
+            installedSha,
+            latestSha,
+            updateAvailable: !!(installedSha && latestSha && installedSha !== latestSha),
+        });
+    }));
+    const items = perRepo.map(({ repo, installedNames }) => {
+        const meta = githubMetaCache.get(repo.source)?.value;
+        const remote = remoteSkillsCache.get(repo.source)?.value;
+        const owner = extractGithubOwner(repo.source);
+        const iconUrl = repo.iconUrl
+            ?? (owner ? `https://github.com/${owner}.png?size=80` : undefined);
+        const firstMatch = installedNames[0]
+            ? installedByName.get(installedNames[0].toLowerCase())
             : undefined;
+        const upd = updateBySource.get(repo.source);
         return {
             id: repo.id,
             name: repo.name,
@@ -689,19 +768,27 @@ app.get('/api/extensions/skills/catalog', async (c) => {
             category: repo.category,
             recommendedScope: repo.recommendedScope,
             homepage: repo.homepage,
-            installed: installedSkillNames.length > 0,
+            installed: installedNames.length > 0,
             scope: firstMatch?.scope,
-            installedNames: installedSkillNames,
+            installedNames,
             stars: meta?.stars,
             pushedAt: meta?.pushedAt,
             iconUrl,
             totalCount: remote?.skills.length,
             partial: remote?.partial,
+            pinned: repo.pinned,
+            updateAvailable: upd?.updateAvailable,
+            installedSha: upd?.installedSha,
+            latestSha: upd?.latestSha,
         };
     });
-    // Authority = community popularity. Sort by stars desc, with no-data entries
-    // sinking to the bottom so the most-loved repos surface first.
-    items.sort((a, b) => (b.stars ?? -1) - (a.stars ?? -1));
+    // Pinned first-party packs lead; then community popularity (stars desc, with
+    // no-data entries sinking to the bottom so the most-loved repos surface first).
+    items.sort((a, b) => {
+        if (!!a.pinned !== !!b.pinned)
+            return a.pinned ? -1 : 1;
+        return (b.stars ?? -1) - (a.stars ?? -1);
+    });
     return c.json({ ok: true, items, installed });
 });
 /** POST /api/extensions/skills/install — install a skill via npx skills add. */
@@ -715,13 +802,39 @@ app.post('/api/extensions/skills/install', async (c) => {
         if (!isGlobal && !isValidWorkdir(workdir)) {
             return c.json({ ok: false, error: 'valid workdir is required for project-scoped install' }, 400);
         }
-        const result = await installSkill(source.trim(), { global: isGlobal, skill, workdir });
+        // Resolve the remote HEAD so installSkill can record provenance for update
+        // detection. Best-effort — a failed lookup just installs without a baseline.
+        const sourceSha = await fetchRepoHeadSha(source.trim()).catch(() => null);
+        const result = await installSkill(source.trim(), { global: isGlobal, skill, workdir, sourceSha });
         return c.json(result);
     }
     catch (e) {
         return c.json({ ok: false, error: e?.message || 'installation failed' }, 500);
     }
 });
+/**
+ * POST /api/extensions/skills/update — pull the latest version of an installed
+ * collection. Re-runs `skills add <source>` (no `-s`, so every skill from the
+ * source is refreshed) and advances the provenance ledger to the new HEAD.
+ */
+app.post('/api/extensions/skills/update', async (c) => {
+    try {
+        const body = await c.req.json();
+        const { source, global: isGlobal, workdir: reqWorkdir } = body;
+        if (!source?.trim())
+            return c.json({ ok: false, error: 'source is required' }, 400);
+        const workdir = reqWorkdir || runtime.getRequestWorkdir();
+        if (!isGlobal && !isValidWorkdir(workdir)) {
+            return c.json({ ok: false, error: 'valid workdir is required for project-scoped update' }, 400);
+        }
+        const sourceSha = await fetchRepoHeadSha(source.trim()).catch(() => null);
+        const result = await installSkill(source.trim(), { global: isGlobal, workdir, sourceSha });
+        return c.json({ ...result, sha: sourceSha });
+    }
+    catch (e) {
+        return c.json({ ok: false, error: e?.message || 'update failed' }, 500);
+    }
+});
 /** POST /api/extensions/skills/remove — remove an installed skill. */
 app.post('/api/extensions/skills/remove', async (c) => {
     try {

package/dist/dashboard/server.js

@@ -9,7 +9,6 @@ import { serveStatic } from '@hono/node-server/serve-static';
 import path from 'node:path';
 import fs from 'node:fs';
 import { exec } from 'node:child_process';
-import { WebSocketServer } from 'ws';
 import configRoutes from './routes/config.js';
 import agentRoutes, { preloadAgentStatus } from './routes/agents.js';
 import sessionRoutes from './routes/sessions.js';
@@ -19,67 +18,15 @@ import modelsRoutes from './routes/models.js';
 import localModelsRoutes from './routes/local-models.js';
 import { runtime } from './runtime.js';
 import { registerProcessRuntime } from '../core/process-control.js';
+import { mountPikichannel } from '../pikichannel/server.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
 const DASHBOARD_PORT_RETRY_LIMIT = 10;
-const WS_KEEPALIVE_MS = 25_000;
-function attachWebSocketServer(httpServer) {
-    const wss = new WebSocketServer({ noServer: true });
-    const clients = new Set();
-    httpServer.on('upgrade', (req, socket, head) => {
-        const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
-        if (url.pathname !== '/ws') {
-            socket.destroy();
-            return;
-        }
-        wss.handleUpgrade(req, socket, head, (ws) => {
-            wss.emit('connection', ws, req);
-        });
-    });
-    wss.on('connection', (ws) => {
-        clients.add(ws);
-        const keepalive = setInterval(() => {
-            if (ws.readyState === ws.OPEN)
-                ws.ping();
-        }, WS_KEEPALIVE_MS);
-        ws.on('message', (raw) => {
-            try {
-                const msg = JSON.parse(String(raw));
-                if (msg?.type === 'ping') {
-                    ws.send(JSON.stringify({ type: 'pong' }));
-                }
-            }
-            catch { /* ignore malformed messages */ }
-        });
-        ws.on('close', () => {
-            clients.delete(ws);
-            clearInterval(keepalive);
-        });
-        ws.on('error', () => {
-            clients.delete(ws);
-            clearInterval(keepalive);
-        });
-    });
-    const onEvent = (event) => {
-        const data = JSON.stringify(event);
-        for (const ws of clients) {
-            if (ws.readyState === ws.OPEN) {
-                ws.send(data);
-            }
-        }
-    };
-    runtime.events.on('dashboard-event', onEvent);
-    const closeAllClients = () => {
-        runtime.events.off('dashboard-event', onEvent);
-        for (const ws of clients)
-            ws.close();
-        clients.clear();
-        wss.close();
-    };
-    httpServer.on('close', closeAllClients);
-    return { closeAllClients };
-}
+// The dashboard's live push transport is pikichannel (`/pikichannel/ws`) — the
+// same universal channel mobile/web clients use. There is no separate dashboard
+// WebSocket layer anymore; the pikichannel adapter subscribes to the runtime
+// 'dashboard-event' bus directly, so the SPA and remote clients share one stack.
 // ---------------------------------------------------------------------------
 // Server
 // ---------------------------------------------------------------------------
@@ -103,6 +50,17 @@ export async function startDashboard(opts = {}) {
     app.route('/', cliRoutes);
     app.route('/', modelsRoutes);
     app.route('/', localModelsRoutes);
+    // -- pikichannel: pluggable agent-session transport (WebSocket + WebRTC) --
+    // Mounted BEFORE the static catch-all so its routes (demo page, browser SDK,
+    // status) win. Returns a handle whose upgrade router is attached per HTTP
+    // server below. Failure here must not block the dashboard, so it is guarded.
+    let pikichannel = null;
+    try {
+        pikichannel = await mountPikichannel(app);
+    }
+    catch (err) {
+        runtime.warn(`[pikichannel] mount failed: ${err?.message || err}`);
+    }
     // -- Static files: serve dashboard build output --
     // Resolve path relative to this file's location (src/ or dist/)
     const dashboardRoot = path.resolve(import.meta.dirname, '..', '..', 'dashboard', 'dist');
@@ -149,7 +107,6 @@ export async function startDashboard(opts = {}) {
     });
     // -- Process runtime registration --
     let nodeServer = null;
-    let wsHandle = null;
     const RESTART_CLOSE_TIMEOUT_MS = 3000;
     const unregisterProcessRuntime = registerProcessRuntime({
         label: 'dashboard',
@@ -158,9 +115,9 @@ export async function startDashboard(opts = {}) {
                 resolve();
                 return;
             }
-            // Close all WebSocket clients first — otherwise server.close() hangs
-            // waiting for persistent connections to end.
-            wsHandle?.closeAllClients();
+            // Tear down pikichannel peers first — otherwise server.close() hangs
+            // waiting for the persistent WebSocket/datachannel connections to end.
+            pikichannel?.stop();
             const timer = setTimeout(resolve, RESTART_CLOSE_TIMEOUT_MS);
             nodeServer.close(() => { clearTimeout(timer); resolve(); });
         }),
@@ -181,8 +138,14 @@ export async function startDashboard(opts = {}) {
                 // before Hono's request listener consumes the connection.
                 const requestListener = getRequestListener(app.fetch);
                 const server = http.createServer(requestListener);
-                // Attach WebSocket BEFORE listening — ensures upgrade events are captured
-                wsHandle = attachWebSocketServer(server);
+                // Single WebSocket-upgrade dispatcher (attached before listening so no
+                // upgrade is missed): pikichannel owns `/pikichannel/*` — its WS data
+                // channel and WebRTC signaling. Anything else is rejected.
+                server.on('upgrade', (req, socket, head) => {
+                    if (pikichannel?.handleUpgrade(req, socket, head))
+                        return;
+                    socket.destroy();
+                });
                 server.listen(port, () => {
                     if (settled)
                         return;