pinomad 0.4.0 → 0.6.0

package/README.md

@@ -1,6 +1,6 @@
 # PiNomad
 
-English · [中文](README.zh-CN.md)
+English · [中文](README.zh-CN.md) · [pinomad.si](https://pinomad.si)
 
 A self-hosted coding agent built on [Pi Durable](https://www.npmjs.com/package/@earendil-works/pi-durable). The agent runs on your own machine; the Mac app, the web client, and the iPhone app all attach to the same runs.
 
@@ -87,8 +87,10 @@ These docs are written in Chinese.
 | [Usage](docs/usage.md) | Projects, worktrees, tools, MCP configuration |
 | [Remote access](docs/remote-access.md) | Pairing, tunnels, self-hosted relay (VPS or container platforms) |
 | [Running as a service](docs/service.md) | `service` and `upgrade` commands, platform notes |
+| [Website](docs/website.md) | The pinomad.si landing page and the hosted app.pinomad.si instance |
+| [Architecture overview](docs/architecture.md) | How the parts and languages fit together, with send/receive diagrams |
 | [Architecture decisions](docs/adr/README.md) | Why things are the way they are |
-| [Roadmap](docs/roadmap.md) | What's done and what's next |
+| [Roadmap](docs/roadmap.md) | Direction and order; items live in GitHub Issues |
 | [Glossary](GLOSSARY.md) | Domain terms |
 
 ## Contributing

package/dist/{chunk-837gh8nr.js → chunk-0xh6cy9v.js}

@@ -3,10 +3,10 @@ import {
   generateKeyPair,
   keyPairFromPrivate,
   toBase64Url
-} from "./chunk-7gmkgyaz.js";
+} from "./chunk-7qb9tq54.js";
 
 // apps/host/src/devices.ts
-import { readFile, writeFile } from "node:fs/promises";
+import { link, readFile, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { ed25519 } from "@noble/curves/ed25519.js";
@@ -62,14 +62,8 @@ async function loadHostKey(dataDir) {
     if (error.code !== "ENOENT")
       throw error;
     const pair = generateKeyPair();
-    try {
-      await writeFile(path, `${toBase64Url(pair.privateKey)}
-`, { flag: "wx", mode: 384 });
-    } catch (race) {
-      if (race.code !== "EEXIST")
-        throw race;
+    if (!await createKeyFile(path, toBase64Url(pair.privateKey)))
       return loadHostKey(dataDir);
-    }
     return pair;
   }
 }
@@ -84,17 +78,26 @@ async function loadRelayKey(dataDir) {
     if (error.code !== "ENOENT")
       throw error;
     const { secretKey, publicKey } = ed25519.keygen();
-    try {
-      await writeFile(path, `${toBase64Url(secretKey)}
-`, { flag: "wx", mode: 384 });
-    } catch (race) {
-      if (race.code !== "EEXIST")
-        throw race;
+    if (!await createKeyFile(path, toBase64Url(secretKey)))
       return loadRelayKey(dataDir);
-    }
     return { secretKey, publicKey };
   }
 }
+async function createKeyFile(path, key) {
+  const tmp = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+  try {
+    await writeFile(tmp, `${key}
+`, { flag: "wx", mode: 384 });
+    await link(tmp, path);
+    return true;
+  } catch (race) {
+    if (race.code !== "EEXIST")
+      throw race;
+    return false;
+  } finally {
+    await unlink(tmp).catch(() => {});
+  }
+}
 function pairingOffers(ttlMs = 5 * 60 * 1000) {
   const live = new Map;
   const prune = () => {
@@ -135,4 +138,53 @@ function pairingOffers(ttlMs = 5 * 60 * 1000) {
   };
 }
 
-export { DevicesDoc, ensureDevices, RevocationsDoc, admitDevice, loadHostKey, loadRelayKey, pairingOffers };
+// apps/host/src/server-config.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { readFile as readFile2, rename, rm, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var SERVER_CONFIG_FILE = "server.json";
+var normalizeOrigin = (origin) => origin.replace(/\/+$/, "");
+async function readServerConfig(dataDir) {
+  let text;
+  try {
+    text = await readFile2(join2(dataDir, SERVER_CONFIG_FILE), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw new Error(`${join2(dataDir, SERVER_CONFIG_FILE)} is not valid JSON — delete it or run \`pinomad leave\``);
+  }
+  const origin = value?.origin;
+  if (typeof origin !== "string" || origin.trim() === "") {
+    throw new Error(`${join2(dataDir, SERVER_CONFIG_FILE)} is missing a string "origin"`);
+  }
+  const binding = value.binding;
+  return {
+    origin,
+    ...typeof binding === "string" && binding !== "" ? { binding } : {}
+  };
+}
+async function writeServerConfig(dataDir, config) {
+  const path = join2(dataDir, SERVER_CONFIG_FILE);
+  const tmp = `${path}.tmp-${process.pid}`;
+  await writeFile2(tmp, `${JSON.stringify({ origin: normalizeOrigin(config.origin), binding: randomBytes2(16).toString("base64url") })}
+`, { mode: 384 });
+  await rename(tmp, path);
+}
+var removeServerConfig = (dataDir) => rm(join2(dataDir, SERVER_CONFIG_FILE), { force: true });
+async function readServerBinding(dataDir) {
+  return (await readServerConfig(dataDir))?.binding;
+}
+function resolveRelayOrigin(flag, config) {
+  if (flag !== undefined && config !== undefined && normalizeOrigin(flag) !== normalizeOrigin(config.origin)) {
+    throw new Error(`--relay ${flag} disagrees with ${SERVER_CONFIG_FILE} (${config.origin}) — remove one`);
+  }
+  return flag ?? config?.origin;
+}
+
+export { DevicesDoc, ensureDevices, RevocationsDoc, admitDevice, loadHostKey, loadRelayKey, pairingOffers, normalizeOrigin, readServerConfig, writeServerConfig, removeServerConfig, readServerBinding, resolveRelayOrigin };

package/dist/{chunk-n73t5xzw.js → chunk-367n9je8.js}

@@ -1,9 +1,9 @@
 import {
   packagedVersion
-} from "./chunk-fgx2sh7d.js";
+} from "./chunk-c8nxym2z.js";
 import {
   hostAddress
-} from "./chunk-cjfmfyjb.js";
+} from "./chunk-ngf1zatm.js";
 import"./chunk-df32avw6.js";
 
 // apps/host/src/cli/web-link.ts

package/dist/{chunk-xhwkx9bd.js → chunk-3dnnaz4j.js}

@@ -3,31 +3,30 @@ import {
   assertSecureServerOrigin,
   probeServerAccounts,
   runServerOperation
-} from "./chunk-5785kwej.js";
+} from "./chunk-ywmm63ks.js";
 import {
+  loadHostKey,
+  loadRelayKey,
   readServerConfig,
   removeServerConfig
-} from "./chunk-302y6by9.js";
-import"./chunk-knaw1a9g.js";
+} from "./chunk-0xh6cy9v.js";
+import {
+  relayHostId
+} from "./chunk-7qb9tq54.js";
 import {
   argValue,
   restartService,
   serviceManager,
   withoutRelayArgs
-} from "./chunk-akgxwg8f.js";
-import"./chunk-fgx2sh7d.js";
-import"./chunk-374zqx5h.js";
-import"./chunk-myjp910s.js";
-import {
-  loadHostKey,
-  loadRelayKey
-} from "./chunk-837gh8nr.js";
-import {
-  relayHostId
-} from "./chunk-7gmkgyaz.js";
+} from "./chunk-d5ypmmr7.js";
+import"./chunk-kzbzacz9.js";
+import"./chunk-c8nxym2z.js";
+import"./chunk-d93kvxvc.js";
+import"./chunk-n4tjhcb7.js";
+import"./chunk-znhn8af7.js";
 import {
   DEFAULT_DATA_DIR
-} from "./chunk-cjfmfyjb.js";
+} from "./chunk-ngf1zatm.js";
 import"./chunk-df32avw6.js";
 
 // apps/host/src/cli/leave.ts