pinomad 0.9.1 → 0.11.0

package/README.md

@@ -16,21 +16,23 @@ A self-hosted coding agent built on [Pi Durable](https://www.npmjs.com/package/@
 
 ## Quick start
 
-The host needs Node 25+ on macOS or Linux.
+1. **Create an account** at [app.pinomad.si](https://app.pinomad.si/) (sign-up is by invite).
+2. **Add your host.** On the machine that should run the agent (macOS or Linux), run the two lines below. `pinomad up` prints a code; enter it on the page it opens, signed in, to add the host to your account. It then runs as a service.
 
-```sh
-npm i -g pinomad
-pinomad host        # data and credentials live in ~/.pinomad
-pinomad link        # in another terminal: prints a browser link to the web client
-```
+   ```sh
+   curl -fsSL https://pinomad.si/install.sh | sh
+   pinomad up
+   ```
 
-Sign in to a model provider under Settings → Providers: a subscription you already pay for (Claude, ChatGPT, Copilot, …), an API key, or your own OpenAI- or Anthropic-compatible endpoint. To click around without one, `pinomad host --faux "hi"` runs a scripted fake model.
+   Already installed with npm? The script leaves that install alone; run `pinomad upgrade`, then `pinomad up`.
 
-To reach the host from your Mac and iPhone anywhere without running a server, [use the official server](https://pinomad.si/docs/official-server/) at app.pinomad.si.
+3. **Sign in on your other devices** (web, Mac app, iPhone). They pair with your hosts on their own; then connect a model provider under Settings → Providers.
+
+To run without an account (one machine, LAN or tailnet, or your own server), see [Without an account](https://pinomad.si/docs/without-account/).
 
 ## Documentation
 
-User docs live on **[pinomad.si/docs](https://pinomad.si/docs/)**: [getting started](https://pinomad.si/docs/) (connecting your other devices, keeping the host running, clients) and [what the agent can do](https://pinomad.si/docs/features/). Usage, remote access, and the service reference are in Chinese for now: [中文文档](https://pinomad.si/zh/docs/).
+User docs live on **[pinomad.si/docs](https://pinomad.si/docs/)**: [getting started](https://pinomad.si/docs/) (account, adding hosts, devices, push), [your account](https://pinomad.si/docs/official-server/), [without an account](https://pinomad.si/docs/without-account/), and [what the agent can do](https://pinomad.si/docs/features/). Usage, remote access, and the service reference are in Chinese for now: [中文文档](https://pinomad.si/zh/docs/).
 
 For contributors (in Chinese):
 

package/dist/{chunk-v414b5pp.js → chunk-44pnts98.js}

@@ -1,13 +1,13 @@
 import {
   RTC_DEFAULT_STUN
-} from "./chunk-jgd38rna.js";
+} from "./chunk-xqycs43g.js";
 import {
   HOST_SETTING_KEYS,
   cleanHostName,
   isQueueMode,
   isThinkingLevel,
   normalizeHostName
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-pqe7q1s7.js";
 
 // apps/host/src/host-value.ts
 function constantValue(value) {

package/dist/{chunk-nj5gz6qh.js → chunk-4dcs8sbj.js}

@@ -3,30 +3,32 @@ import {
   assertSecureServerOrigin,
   probeServerAccounts,
   runServerOperation
-} from "./chunk-3p1eysm9.js";
+} from "./chunk-ncbqa8jk.js";
 import {
   loadHostKey,
-  loadRelayKey,
+  loadRelayKey
+} from "./chunk-t91zt5f0.js";
+import {
   readServerConfig,
   removeServerConfig
-} from "./chunk-5gp9svzs.js";
+} from "./chunk-etf7ef97.js";
 import {
   relayHostId
-} from "./chunk-khcpv54k.js";
+} from "./chunk-y127fe1a.js";
 import {
   argValue,
   restartService,
   serviceManager,
   withoutRelayArgs
-} from "./chunk-32g3m2h0.js";
+} from "./chunk-vvj9b1gc.js";
+import"./chunk-jt34g8st.js";
 import"./chunk-kzbzacz9.js";
-import"./chunk-fqgvf8v0.js";
-import"./chunk-4sepcfpy.js";
-import"./chunk-jgd38rna.js";
-import"./chunk-sygeb9qb.js";
+import"./chunk-xqycs43g.js";
+import"./chunk-pqe7q1s7.js";
 import {
   DEFAULT_DATA_DIR
 } from "./chunk-ngf1zatm.js";
+import"./chunk-sd5fkxjj.js";
 import"./chunk-df32avw6.js";
 
 // apps/host/src/cli/leave.ts

package/dist/{chunk-n8cz7skh.js → chunk-67gq282t.js}

@@ -1,14 +1,11 @@
 #!/usr/bin/env node
-import {
-  serveWebClient
-} from "./chunk-wb10efyq.js";
 import {
   Published,
   constantValue,
   openHostSettings,
   sameList,
   settingsDefaults
-} from "./chunk-v414b5pp.js";
+} from "./chunk-44pnts98.js";
 import {
   DevicesDoc,
   RevocationsDoc,
@@ -16,21 +13,22 @@ import {
   ensureDevices,
   loadHostKey,
   loadRelayKey,
+  pairingOffers
+} from "./chunk-t91zt5f0.js";
+import {
   normalizeOrigin,
-  pairingOffers,
   readServerBinding,
   readServerConfig,
   resolveRelayOrigin
-} from "./chunk-5gp9svzs.js";
+} from "./chunk-etf7ef97.js";
+import {
+  serveWebClient
+} from "./chunk-wb10efyq.js";
 import {
   relayHostId,
   relayWsBase,
   startRelayLink
-} from "./chunk-khcpv54k.js";
-import {
-  packagedVersion,
-  webRoot
-} from "./chunk-fqgvf8v0.js";
+} from "./chunk-y127fe1a.js";
 import {
   ATTACHMENT_TTL_MS,
   INVALID_FRAME_CLOSE_CODE,
@@ -56,7 +54,7 @@ import {
   rtcCandidateType,
   sdpCandidates,
   withRtcCandidates
-} from "./chunk-jgd38rna.js";
+} from "./chunk-xqycs43g.js";
 import {
   ENDPOINT_SET_SCHEMA_VERSION,
   MAX_HOST_ENDPOINT_URL_LENGTH,
@@ -72,10 +70,14 @@ import {
   parseEndpointSet,
   respondIK,
   toBase64Url
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-pqe7q1s7.js";
 import {
   DEFAULT_DATA_DIR
 } from "./chunk-ngf1zatm.js";
+import {
+  packagedVersion,
+  webRoot
+} from "./chunk-sd5fkxjj.js";
 import {
   __require
 } from "./chunk-df32avw6.js";
@@ -3355,6 +3357,14 @@ async function startGateway(options) {
   };
   let remote;
   let relay;
+  const closeDevice = (publicKey) => {
+    for (const connection of [...connections]) {
+      if (connection.devicePublicKey === publicKey) {
+        connection.closeConnection(UNAUTHORIZED_CLOSE_CODE, "device revoked");
+      }
+    }
+    rtc?.closeDevice(publicKey);
+  };
   const currentAdvertisement = () => {
     const advertiseUrl = remote?.advertiseUrl;
     const endpoints = remoteEndpointCandidates({
@@ -3381,14 +3391,7 @@ async function startGateway(options) {
         rtc?.closeOwner(self);
         self.dispose();
       },
-      closeDevice: (publicKey) => {
-        for (const connection2 of [...connections]) {
-          if (connection2.devicePublicKey === publicKey) {
-            connection2.closeConnection(UNAUTHORIZED_CLOSE_CODE, "device revoked");
-          }
-        }
-        rtc?.closeDevice(publicKey);
-      },
+      closeDevice,
       rtcOffer: (owner, key, attempt, sdp) => {
         if (rtc === undefined)
           throw new Error("WebRTC is not available on this host");
@@ -3462,7 +3465,8 @@ async function startGateway(options) {
     acceptAccountDevices: () => options.settings.value.acceptAccountDevices,
     serverBinding: async () => await readServerBinding(options.dataDir).catch(() => {
       return;
-    })
+    }),
+    accountAdmitted: (requestId, publicKey) => relay?.reportAdmitted(requestId, publicKey)
   };
   const secure = options.secure;
   const handshakeHandlers = {
@@ -3515,6 +3519,16 @@ async function startGateway(options) {
   });
   if (secure?.relay !== undefined) {
     const relayOrigin = secure.relay.origin;
+    const currentBinding = async () => {
+      const config = await readServerConfig(options.dataDir).catch(() => {
+        return;
+      });
+      if (config?.binding === undefined)
+        return { refused: "not_joined" };
+      if (normalizeOrigin(config.origin) !== normalizeOrigin(relayOrigin))
+        return { refused: "rebinding" };
+      return { binding: config.binding };
+    };
     let link;
     link = startRelayLink({
       origin: relayOrigin,
@@ -3527,17 +3541,12 @@ async function startGateway(options) {
         },
         subscribe: (listener) => options.settings.subscribe((settings) => listener(settings.hostName))
       },
-      accountOffer: async () => {
+      accountOffer: async (requestId) => {
         if (!options.settings.value.acceptAccountDevices)
           return { ok: false, reason: "disabled" };
-        const config = await readServerConfig(options.dataDir).catch(() => {
-          return;
-        });
-        if (config?.binding === undefined)
-          return { ok: false, reason: "not_joined" };
-        if (normalizeOrigin(config.origin) !== normalizeOrigin(relayOrigin)) {
-          return { ok: false, reason: "rebinding" };
-        }
+        const bound = await currentBinding();
+        if ("refused" in bound)
+          return { ok: false, reason: bound.refused };
         let endpointSet;
         try {
           const current = checkedEndpointSet(currentAdvertisement().endpoints);
@@ -3545,9 +3554,18 @@ async function startGateway(options) {
         } catch {
           return { ok: false, reason: "invalid_endpoint" };
         }
-        const { secret, expiresAt } = secure.offers.createAccount(config.binding);
+        const { secret, expiresAt } = secure.offers.createAccount(bound.binding, requestId);
         return { ok: true, secret, expiresAt, ...endpointSet === undefined ? {} : { endpointSet } };
       },
+      deviceReports: {
+        revoke: async (publicKey) => {
+          const bound = await currentBinding();
+          if ("refused" in bound)
+            throw new Error(`revocation refused: ${bound.refused}`);
+          await revokeDevice(options.harness, publicKey, context3);
+          closeDevice(publicKey);
+        }
+      },
       onStateChange: (state) => {
         if (state.status === "registered") {
           const push = state.push === undefined ? "undeclared" : state.push.length === 0 ? "none" : state.push.join(",");
@@ -3817,6 +3835,9 @@ function secureHandshake(carrier, secure, policy, handlers) {
           carrier.close(UNAUTHORIZED_CLOSE_CODE, "unauthorized");
           return;
         }
+        if (decision.outcome === "admitted" && decision.requestId !== undefined) {
+          policy.accountAdmitted(decision.requestId, deviceKey);
+        }
         const { message, result: result2 } = responder.writeMessage2(encodeHostHello({ v: 1 }));
         return {
           result: result2,

package/dist/{chunk-azarj0f4.js → chunk-6d16c2fv.js}

@@ -2,30 +2,38 @@
 import {
   restartService,
   serviceManager
-} from "./chunk-32g3m2h0.js";
+} from "./chunk-vvj9b1gc.js";
+import"./chunk-jt34g8st.js";
 import"./chunk-kzbzacz9.js";
+import"./chunk-xqycs43g.js";
+import"./chunk-pqe7q1s7.js";
+import {
+  hostAddressOptions
+} from "./chunk-ngf1zatm.js";
 import {
   globalPrefixOf,
   packageDir,
   packagedVersion
-} from "./chunk-fqgvf8v0.js";
-import"./chunk-4sepcfpy.js";
-import"./chunk-jgd38rna.js";
-import"./chunk-sygeb9qb.js";
-import {
-  hostAddressOptions
-} from "./chunk-ngf1zatm.js";
+} from "./chunk-sd5fkxjj.js";
 import"./chunk-df32avw6.js";
 
 // apps/host/src/cli/upgrade.ts
 import { execFile, spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs, promisify } from "node:util";
 var exec = promisify(execFile);
 var repoRoot = fileURLToPath(new URL("../../../../", import.meta.url));
-var step = (command, args) => new Promise((resolve) => {
-  spawn(command, [...args], { cwd: repoRoot, stdio: "inherit" }).once("exit", (code) => resolve(code ?? 1));
+var step = (command, args, binDir) => new Promise((resolve) => {
+  const env = binDir === undefined ? process.env : { ...process.env, PATH: `${binDir}:${process.env.PATH ?? ""}` };
+  spawn(command, [...args], { cwd: repoRoot, env, stdio: "inherit" }).once("exit", (code) => resolve(code ?? 1));
 });
+function npmBeside(execPath) {
+  const binDir = dirname(execPath);
+  const cli = join(binDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js");
+  return existsSync(cli) ? { command: execPath, args: [cli], binDir } : { command: "npm", args: [] };
+}
 var serviceInstalled = () => Promise.resolve().then(() => serviceManager().state()).then((state) => state.installed, () => false);
 async function main(argv, deps = {}) {
   const { values } = parseArgs({
@@ -60,7 +68,8 @@ async function main(argv, deps = {}) {
       process.exitCode = 1;
       return;
     }
-    const code = await runStep("npm", ["install", "-g", "--prefix", prefix, "pinomad@latest"]);
+    const npm = npmBeside(process.execPath);
+    const code = await runStep(npm.command, [...npm.args, "install", "-g", "--prefix", prefix, "pinomad@latest"], npm.binDir);
     if (code !== 0) {
       process.exitCode = code;
       return;
@@ -75,5 +84,6 @@ async function main(argv, deps = {}) {
 }
 if (false) {}
 export {
+  npmBeside,
   main
 };