pipane 0.1.5 → 0.1.7

package/README.md

@@ -18,6 +18,8 @@ Walkthrough (GIF):
 
 ## Quickstarts
 
+Requires Node.js 22.19 or newer, matching the bundled Pi runtime and extension APIs.
+
 ```bash
 npm install -g pipane
 ```
@@ -25,7 +27,30 @@ npm install -g pipane
 If `pi` is missing, install it like this:
 
 ```bash
-npm install -g @mariozechner/pi-coding-agent
+npm install -g @earendil-works/pi-coding-agent
+```
+
+### Explicit local deployments
+
+Deploy the current working tree to the separate dev instance with:
+
+```bash
+npm run deploy:dev
+```
+
+This builds a release, atomically advances the `pipane-dev` systemd service, and verifies it on port `8223`. It does not change production.
+
+Deploy the current committed working tree to local production with:
+
+```bash
+npm run deploy:prod
+```
+
+Production deployment requires a clean Git working tree, atomically advances the `pipane` systemd service, verifies it on port `8222`, and rolls back if the health check fails. Both commands skip dependency installation when `package-lock.json` is unchanged and retain five releases.
+
+```bash
+journalctl -u pipane-dev -f
+journalctl -u pipane -f
 ```
 
 ---
@@ -35,10 +60,29 @@ npm install -g @mariozechner/pi-coding-agent
 - Session list and clean UI for `pi`
 - Real-time tool calls and streaming output, nicely crafted
 - A nice session picker
+- ChatGPT/Codex and Claude subscription usage in the input toolbar
 - A large amount high quality "vibe-code".
 
+Provider usage is supplied by the bundled `@sreetej510/pi-usage` Pi extension and uses Pi's existing authentication. Set `PIPANE_USAGE_EXTENSION=0` when starting pipane to disable it.
+
 ---
 
+## Browser UI ownership
+
+The renderer tree under [`src/client/ui/`](src/client/ui/) is maintained directly by pipane. It is derived from the final pi-mono `web-ui` release (`v0.75.3`) with pipane's flat message renderer, steering editor, thinking display, attachment handling, and tool renderers integrated into one local path. Pipane does not patch or load an external `pi-web-ui` package. See [`UPSTREAM.md`](src/client/ui/UPSTREAM.md) and [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md).
+
+The versioned browser WebSocket contract and validated Pi subprocess boundary are documented in [`docs/protocol.md`](docs/protocol.md).
+
+## Testing
+
+Run the complete local verification gate with:
+
+```bash
+npm run test:all
+```
+
+This typechecks the repository, runs Vitest with coverage thresholds, builds the production client/server, and runs the deterministic Playwright suite. The real-credential walkthrough is separate: `npm run test:walkthrough`.
+
 ## License
 
 [MIT](LICENSE)

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,29 @@
+# Third-party notices
+
+## pi-web-ui
+
+Parts of pipane's browser component tree in `src/client/ui/` are derived from
+`packages/web-ui` in [badlogic/pi-mono](https://github.com/badlogic/pi-mono),
+tag `v0.75.3`.
+
+MIT License
+
+Copyright (c) 2025 Mario Zechner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bin/pipane-rendezvous.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const serverEntry = path.resolve(__dirname, "../dist/server/rendezvous/server.js");
+
+if (process.env.PIPANE_PRINT_ENTRY === "1") {
+	process.stdout.write(serverEntry);
+	process.exit(0);
+}
+
+const child = spawn(process.execPath, [serverEntry, ...process.argv.slice(2)], {
+	stdio: "inherit",
+	env: { ...process.env, NODE_ENV: process.env.NODE_ENV || "production" },
+});
+
+child.on("exit", (code) => {
+	process.exit(code ?? 0);
+});

package/bin/pipane.js

@@ -2,6 +2,7 @@
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import qrcode from "qrcode-terminal";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const serverEntry = path.resolve(__dirname, "../dist/server/server/server.js");
@@ -11,8 +12,27 @@ if (process.env.PIPANE_PRINT_ENTRY === "1") {
 	process.exit(0);
 }
 
+const args = process.argv.slice(2);
+if (args[0] === "pair") {
+	const endpoint = process.env.PIPANE_PAIR_ENDPOINT || `http://127.0.0.1:${process.env.PORT || "8222"}/api/pairing`;
+	try {
+		const headers = process.env.PIPANE_AUTH_TOKEN
+			? { cookie: `pipane_auth=${encodeURIComponent(process.env.PIPANE_AUTH_TOKEN)}` }
+			: undefined;
+		const response = await fetch(endpoint, { method: "POST", headers, signal: AbortSignal.timeout(10_000) });
+		const value = await response.json();
+		if (!response.ok || typeof value?.url !== "string") throw new Error(value?.error || `Pairing request failed (${response.status})`);
+		process.stdout.write(`${value.url}\n`);
+		qrcode.generate(value.url, { small: true }, (code) => process.stdout.write(`${code}\n`));
+		process.exit(0);
+	} catch (error) {
+		process.stderr.write(`Could not create pairing link: ${error instanceof Error ? error.message : String(error)}\n`);
+		process.exit(1);
+	}
+}
+
 // Pass through CLI args (e.g. --verbose)
-const child = spawn(process.execPath, [serverEntry, ...process.argv.slice(2)], {
+const child = spawn(process.execPath, [serverEntry, ...args], {
 	stdio: "inherit",
 	env: { ...process.env, NODE_ENV: process.env.NODE_ENV || "production" },
 });

package/dist/client/assets/__vite-browser-external-DtLbhLGx.js

@@ -0,0 +1 @@
+const a=2;function f(e){return JSON.stringify(e)}function _(e){const r=d(e);if(!r.ok)return r;const n=r.value,o=typeof n.id=="string"?n.id:null,u=typeof n.method=="string"?n.method:"";if(n.kind!=="response"||!s(n.id)||!s(n.method)||typeof n.success!="boolean")return t("invalid_request","Backend response envelope is malformed",o,u);if(n.success){if(!("result"in n))return t("invalid_request","Successful response is missing result",n.id,n.method)}else if(!c(n.error))return t("invalid_request","Failed response is missing a valid error",n.id,n.method);return{ok:!0,value:n}}function p(e){const r=e.slice(0,128);return/"v"\s*:\s*2(?:\s*[,}])/u.test(r)&&/"kind"\s*:\s*"(?:request|response|event)"/u.test(r)}function d(e){if(new TextEncoder().encode(e).byteLength>3145728)return t("invalid_request","Backend frame exceeds the size limit",null,"");let r;try{r=JSON.parse(e)}catch{return t("invalid_json","Backend frame is not valid JSON",null,"")}return i(r)?r.v!==2?t("unsupported_version",`Unsupported backend protocol version: ${String(r.v)}`,null,""):{ok:!0,value:r}:t("invalid_request","Backend frame must be an object",null,"")}function c(e){return i(e)&&l(e.code)&&s(e.message)}function l(e){return typeof e=="string"&&["invalid_json","invalid_request","unsupported_version","unknown_method","not_found","forbidden","conflict","internal_error"].includes(e)}function t(e,r,n,o){return{ok:!1,error:{code:e,message:r},requestId:n,method:o}}function i(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function s(e){return typeof e=="string"&&e.length>0}const m=Object.freeze(Object.defineProperty({__proto__:null},Symbol.toStringTag,{value:"Module"}));export{a as B,m as _,_ as d,f as e,p as i};

package/dist/client/assets/app-runtime-Rw-O-AwW.js

@@ -0,0 +1 @@
+let e;function i(n){if(e)throw new Error("Application runtime is already configured");e=n}function r(n){return e??{client:n()}}export{i as configureAppRuntime,r as consumeAppRuntime};

package/dist/client/assets/backend-landing-page-B7SbyIXQ.js

@@ -0,0 +1 @@
+import{B as u}from"./__vite-browser-external-DtLbhLGx.js";import{R as x,a as b}from"./rendezvous-trust-api-C2Zob5i4.js";const y={loadIdentity:()=>b(),createTrustApi:()=>new x(window.location.origin),confirm:e=>window.confirm(e)};async function v(e=y){const l=document.getElementById("app")??document.body;l.replaceChildren();const r=document.createElement("main");r.dataset.testid="backend-landing",r.style.cssText="min-height:100vh;padding:40px 24px;font-family:ui-sans-serif,system-ui;color:var(--foreground,#111827);background:var(--background,#fff)";const i=document.createElement("section");i.style.cssText="width:min(760px,100%);margin:0 auto";const t=document.createElement("h1");t.textContent="Your pipane backends",t.style.cssText="margin:0 0 8px;font-size:28px";const s=document.createElement("p");s.textContent="Connections are opened directly and only when you choose a backend.",s.style.cssText="margin:0 0 24px;opacity:.72";const n=document.createElement("div");n.dataset.testid="backend-list",n.style.cssText="display:grid;gap:12px";const d=document.createElement("p");d.style.cssText="margin-top:24px;padding-top:18px;border-top:1px solid var(--border,#d1d5db);opacity:.78;line-height:1.5",d.textContent="Add a backend or recover this browser by running `pipane pair` in an owned backend terminal and scanning its QR code.",i.append(t,s,n,d),r.append(i),l.append(r);const c=await e.loadIdentity();if(!c){n.append(m("No paired browser key was found.","Use `pipane pair` on a backend to begin without creating an account."));return}const o=e.createTrustApi();let a;try{a=await o.listAuthorizedBackends(c)}catch(p){n.append(m("Backend access could not be recovered from this device key.",p instanceof Error?p.message:"Pair this browser again from an owned backend terminal."));return}if(a.length===0){n.append(m("No backends are paired.","Run `pipane pair` in a backend terminal to add one."));return}for(const p of a)n.append(f(p,c,o,e))}function f(e,l,r,i){const t=document.createElement("article");t.dataset.backendId=e.backendId,t.style.cssText="display:flex;align-items:center;gap:14px;border:1px solid var(--border,#d1d5db);border-radius:10px;padding:16px";const s=document.createElement("div");s.style.cssText="min-width:0;flex:1";const n=document.createElement("strong");n.textContent=e.name||`${e.backendId.slice(0,18)}…`,n.style.cssText="display:block;white-space:nowrap;overflow:hidden;text-overflow:ellipsis";const d=document.createElement("small"),c=e.protocolVersions.includes(u);d.textContent=e.online?c?`Online${e.softwareVersion?` · v${e.softwareVersion}`:""}`:"Online · update required":"Offline",d.style.cssText=`color:${e.online&&c?"#15803d":"#a16207"}`,s.append(n,d);const o=document.createElement("a");o.textContent="Open",o.href=`/backend/${encodeURIComponent(e.backendId)}`,o.dataset.testid="open-backend",o.style.cssText="border-radius:8px;padding:8px 12px;background:#2563eb;color:white;text-decoration:none",(!e.online||!c)&&(o.removeAttribute("href"),o.setAttribute("aria-disabled","true"),o.style.opacity=".45");const a=document.createElement("button");return a.type="button",a.textContent="Remove",a.style.cssText="border:0;background:transparent;color:#dc2626;cursor:pointer",a.addEventListener("click",()=>{i.confirm(`Remove ${e.name||e.backendId} from this account?`)&&(a.disabled=!0,r.revokeBackend(l,e.backendId).then(()=>t.remove()).catch(p=>{a.disabled=!1,d.textContent=p instanceof Error?p.message:"Removal failed",d.style.color="#dc2626"}))}),t.append(s,o,a),t}function m(e,l){const r=document.createElement("div");r.style.cssText="border:1px solid var(--border,#d1d5db);border-radius:10px;padding:18px;line-height:1.5";const i=document.createElement("strong");i.textContent=e;const t=document.createElement("p");return t.textContent=l,t.style.cssText="margin:6px 0 0;opacity:.72",r.append(i,t),r}export{v as initializeBackendLandingPage};

package/dist/client/assets/index-DwbBcYUf.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/pairing-page-D-WxlWZR.js","assets/rendezvous-trust-api-C2Zob5i4.js","assets/webrtc-frame-transport-BijNnA7N.js","assets/backend-landing-page-B7SbyIXQ.js","assets/__vite-browser-external-DtLbhLGx.js","assets/remote-backend-manager-BWuGh30I.js","assets/ws-agent-adapter-BRysf-Y7.js","assets/main-LGItV9Aj.js","assets/app-runtime-Rw-O-AwW.js"])))=>i.map(i=>d[i]);
+(function(){const e=document.createElement("link").relList;if(e&&e.supports&&e.supports("modulepreload"))return;for(const t of document.querySelectorAll('link[rel="modulepreload"]'))a(t);new MutationObserver(t=>{for(const r of t)if(r.type==="childList")for(const i of r.addedNodes)i.tagName==="LINK"&&i.rel==="modulepreload"&&a(i)}).observe(document,{childList:!0,subtree:!0});function o(t){const r={};return t.integrity&&(r.integrity=t.integrity),t.referrerPolicy&&(r.referrerPolicy=t.referrerPolicy),t.crossOrigin==="use-credentials"?r.credentials="include":t.crossOrigin==="anonymous"?r.credentials="omit":r.credentials="same-origin",r}function a(t){if(t.ep)return;t.ep=!0;const r=o(t);fetch(t.href,r)}})();const w="modulepreload",y=function(n){return"/"+n},p={},f=function(e,o,a){let t=Promise.resolve();if(o&&o.length>0){let m=function(c){return Promise.all(c.map(l=>Promise.resolve(l).then(u=>({status:"fulfilled",value:u}),u=>({status:"rejected",reason:u}))))};document.getElementsByTagName("link");const i=document.querySelector("meta[property=csp-nonce]"),s=i?.nonce||i?.getAttribute("nonce");t=m(o.map(c=>{if(c=y(c),c in p)return;p[c]=!0;const l=c.endsWith(".css"),u=l?'[rel="stylesheet"]':"";if(document.querySelector(`link[href="${c}"]${u}`))return;const d=document.createElement("link");if(d.rel=l?"stylesheet":w,l||(d.as="script"),d.crossOrigin="",d.href=c,s&&d.setAttribute("nonce",s),document.head.appendChild(d),l)return new Promise((h,g)=>{d.addEventListener("load",h),d.addEventListener("error",()=>g(new Error(`Unable to preload CSS for ${c}`)))})}))}function r(i){const s=new Event("vite:preloadError",{cancelable:!0});if(s.payload=i,window.dispatchEvent(s),!s.defaultPrevented)throw i}return t.then(i=>{for(const s of i||[])s.status==="rejected"&&r(s.reason);return e().catch(r)})};"serviceWorker"in navigator&&navigator.serviceWorker.getRegistrations().then(n=>{for(const e of n)e.unregister()});v();async function v(){if(P(window.location.pathname)){const{initializePairingPage:e}=await f(async()=>{const{initializePairingPage:o}=await import("./pairing-page-D-WxlWZR.js");return{initializePairingPage:o}},__vite__mapDeps([0,1,2]));await e();return}if(window.location.pathname==="/"&&await E()){const{initializeBackendLandingPage:e}=await f(async()=>{const{initializeBackendLandingPage:o}=await import("./backend-landing-page-B7SbyIXQ.js");return{initializeBackendLandingPage:o}},__vite__mapDeps([3,4,1]));await e();return}const n=b(window.location.pathname);if(n)try{const[{configureAppRuntime:e},{RemoteBackendManager:o}]=await Promise.all([f(()=>import("./app-runtime-Rw-O-AwW.js"),[]),f(()=>import("./remote-backend-manager-BWuGh30I.js"),__vite__mapDeps([5,4,1,2,6]))]),a=new o(window.location.origin),t=await a.initialize();e({client:a.getClient(n),remote:{backendId:n,backends:t,manager:a}})}catch(e){_(e);return}await f(()=>import("./main-LGItV9Aj.js"),__vite__mapDeps([7,6,4,8]))}async function E(){try{const n=await fetch("/health",{cache:"no-store"});if(!n.ok||!n.headers.get("content-type")?.includes("application/json"))return!1;const e=await n.json();return!!e&&typeof e=="object"&&e.ok===!0}catch{return!1}}function _(n){const e=document.getElementById("app")??document.body;e.replaceChildren();const o=document.createElement("main");o.style.cssText="min-height:100vh;display:grid;place-items:center;padding:24px;font-family:ui-sans-serif,system-ui;color:var(--foreground,#111827);background:var(--background,#fff)";const a=document.createElement("section");a.style.cssText="max-width:520px;border:1px solid var(--border,#d1d5db);border-radius:12px;padding:28px";const t=document.createElement("h1");t.textContent="Cannot open backend";const r=document.createElement("p");r.textContent=n instanceof Error?n.message:"This browser is not authorized for the backend.";const i=document.createElement("p");i.textContent="To restore access, run `pipane pair` in the backend terminal and scan the new QR code with this browser.",a.append(t,r,i),o.append(a),e.append(o)}function P(n){return/^\/pair\/[^/]+$/u.test(n)}function b(n){const e=/^\/backend\/([^/]+)$/u.exec(n);return e?.[1]?decodeURIComponent(e[1]):void 0}export{f as _};