pipane 0.1.6 → 0.1.7

package/dist/server/server/session-jsonl.js

@@ -19,6 +19,31 @@ import { computeSyncOp } from "../shared/jsonl-sync.js";
 function computeHashSync(data) {
     return createHash("sha256").update(data, "utf8").digest("hex");
 }
+function messageTimestamp(message) {
+    const timestamp = message.timestamp;
+    return typeof timestamp === "number" && Number.isFinite(timestamp) ? timestamp : undefined;
+}
+function inferToolCallTimings(messages) {
+    const timings = {};
+    for (const message of messages) {
+        if (message.role === "assistant") {
+            const startedAt = messageTimestamp(message);
+            if (startedAt === undefined)
+                continue;
+            for (const part of message.content) {
+                if (part.type === "toolCall")
+                    timings[part.id] ??= { startedAt };
+            }
+        }
+        else if (message.role === "toolResult") {
+            const completedAt = messageTimestamp(message);
+            const timing = timings[message.toolCallId];
+            if (timing && completedAt !== undefined)
+                timing.completedAt = completedAt;
+        }
+    }
+    return timings;
+}
 // ── SessionJsonl ───────────────────────────────────────────────────────────
 export class SessionJsonl {
     // ── Internal state (used to build the JSON) ────────────────────────────
@@ -26,6 +51,7 @@ export class SessionJsonl {
     _streamMessage = null;
     _pendingToolCalls = [];
     _partialToolResults = {};
+    _toolCallTimings;
     _model;
     _thinkingLevel;
     _steeringQueue = [];
@@ -37,6 +63,7 @@ export class SessionJsonl {
     _version = 1;
     constructor(init) {
         this._messages = init.messages;
+        this._toolCallTimings = init.toolCallTimings ?? inferToolCallTimings(init.messages);
         this._model = init.model;
         this._thinkingLevel = init.thinkingLevel;
         // Build initial JSON
@@ -78,6 +105,11 @@ export class SessionJsonl {
         this._streamMessage = null;
         this._pendingToolCalls = [];
         this._partialToolResults = {};
+        const inferredTimings = inferToolCallTimings(messages);
+        this._toolCallTimings = Object.fromEntries(Object.keys(inferredTimings).map((id) => [
+            id,
+            { ...inferredTimings[id], ...this._toolCallTimings[id] },
+        ]));
         this._version++;
         this.rebuildJson();
     }
@@ -135,6 +167,10 @@ export class SessionJsonl {
                 const toolCallId = event.toolCallId;
                 if (toolCallId && !this._pendingToolCalls.includes(toolCallId)) {
                     this._pendingToolCalls = [...this._pendingToolCalls, toolCallId];
+                    this._toolCallTimings = {
+                        ...this._toolCallTimings,
+                        [toolCallId]: { startedAt: Date.now() },
+                    };
                     this._version++;
                     this.rebuildJson();
                     return true;
@@ -156,6 +192,13 @@ export class SessionJsonl {
                 const toolCallId = event.toolCallId;
                 if (toolCallId) {
                     this._pendingToolCalls = this._pendingToolCalls.filter(id => id !== toolCallId);
+                    const timing = this._toolCallTimings[toolCallId];
+                    if (timing && timing.completedAt === undefined) {
+                        this._toolCallTimings = {
+                            ...this._toolCallTimings,
+                            [toolCallId]: { ...timing, completedAt: Date.now() },
+                        };
+                    }
                     if (toolCallId in this._partialToolResults) {
                         const { [toolCallId]: _, ...rest } = this._partialToolResults;
                         this._partialToolResults = rest;
@@ -178,8 +221,11 @@ export class SessionJsonl {
      * @param clientVersion - The client's last known version
      * @returns SyncOp to send, or null if nothing changed
      */
-    computeSyncOp(clientJson, clientHash, clientVersion) {
-        if (this._version === clientVersion && clientHash === this._hash)
+    computeSyncOp(clientJson, clientHash, _clientVersion) {
+        // Some Pi lifecycle events advance the internal version without changing
+        // the serialized state. Do not emit a same-revision empty delta: wire
+        // revisions describe observable state changes, not internal event counts.
+        if (clientHash === this._hash)
             return null;
         return computeSyncOp(clientJson, this._json, clientHash, this._hash);
     }
@@ -216,6 +262,7 @@ export class SessionJsonl {
             messages,
             isStreaming: true,
             pendingToolCalls: this._pendingToolCalls,
+            toolCallTimings: this._toolCallTimings,
             model: this._model,
             thinkingLevel: this._thinkingLevel,
             steeringQueue: this._steeringQueue,
@@ -243,12 +290,39 @@ export class SessionJsonl {
  * keeps the completed marker where the user ran /compact while still omitting
  * the older messages replaced by the summary.
  */
-export function buildSessionDisplayMessages(entries) {
+function buildSessionDisplayEntries(entries) {
     const sessionEntries = entries.filter((entry) => entry.type !== "session");
     const entryOrder = new Map(sessionEntries.map((entry, index) => [entry, index]));
     return [...buildContextEntries(sessionEntries)]
-        .sort((left, right) => (entryOrder.get(left) ?? 0) - (entryOrder.get(right) ?? 0))
-        .flatMap(sessionEntryToContextMessages);
+        .sort((left, right) => (entryOrder.get(left) ?? 0) - (entryOrder.get(right) ?? 0));
+}
+export function buildSessionDisplayMessages(entries) {
+    return buildSessionDisplayEntries(entries).flatMap(sessionEntryToContextMessages);
+}
+function buildSessionToolCallTimings(entries) {
+    const timings = {};
+    for (const entry of buildSessionDisplayEntries(entries)) {
+        if (entry.type !== "message")
+            continue;
+        const entryTimestamp = new Date(entry.timestamp).getTime();
+        const timestamp = Number.isFinite(entryTimestamp)
+            ? entryTimestamp
+            : messageTimestamp(entry.message);
+        if (timestamp === undefined)
+            continue;
+        if (entry.message.role === "assistant") {
+            for (const part of entry.message.content) {
+                if (part.type === "toolCall")
+                    timings[part.id] ??= { startedAt: timestamp };
+            }
+        }
+        else if (entry.message.role === "toolResult") {
+            const timing = timings[entry.message.toolCallId];
+            if (timing)
+                timing.completedAt = timestamp;
+        }
+    }
+    return timings;
 }
 /**
  * Read a session from disk and return a serialized SessionState JSON + hash.
@@ -257,6 +331,7 @@ export function readSessionFromDisk(sessionPath) {
     let messages = [];
     let model = null;
     let thinkingLevel = "off";
+    let toolCallTimings = {};
     try {
         if (existsSync(sessionPath)) {
             const content = readFileSync(sessionPath, "utf8");
@@ -264,6 +339,7 @@ export function readSessionFromDisk(sessionPath) {
             const sessionEntries = entries.filter((entry) => entry.type !== "session");
             const context = buildSessionContext(sessionEntries);
             messages = buildSessionDisplayMessages(entries);
+            toolCallTimings = buildSessionToolCallTimings(entries);
             model = context.model ?? null;
             thinkingLevel = context.thinkingLevel ?? "off";
         }
@@ -275,6 +351,7 @@ export function readSessionFromDisk(sessionPath) {
         messages,
         isStreaming: false,
         pendingToolCalls: [],
+        toolCallTimings,
         model,
         thinkingLevel,
         steeringQueue: [],

package/dist/server/server/session-path.js

@@ -0,0 +1,145 @@
+import { realpathSync, statSync } from "node:fs";
+import path from "node:path";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+export class SessionPathError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "SessionPathError";
+    }
+}
+function isWithin(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative !== ""
+        && relative !== ".."
+        && !relative.startsWith(`..${path.sep}`)
+        && !path.isAbsolute(relative);
+}
+function errorCode(error) {
+    return typeof error === "object" && error !== null && "code" in error
+        ? String(error.code)
+        : undefined;
+}
+/** Canonicalizes and confines all client-provided Pi session file paths. */
+export class SessionPathGuard {
+    configuredRoot;
+    constructor(sessionsRoot = path.join(getAgentDir(), "sessions")) {
+        this.configuredRoot = path.resolve(sessionsRoot);
+    }
+    resolveExisting(value) {
+        const candidate = this.resolveLexical(value);
+        const canonicalRoot = this.resolveRoot();
+        let canonicalCandidate;
+        try {
+            canonicalCandidate = realpathSync(candidate);
+        }
+        catch (error) {
+            if (errorCode(error) === "ENOENT" || errorCode(error) === "ENOTDIR") {
+                throw new SessionPathError("Session file not found", "not_found");
+            }
+            throw new SessionPathError("Invalid session path", "invalid");
+        }
+        if (path.extname(canonicalCandidate) !== ".jsonl" || !isWithin(canonicalRoot, canonicalCandidate)) {
+            throw new SessionPathError("Session path escapes the Pi sessions directory", "invalid");
+        }
+        try {
+            if (!statSync(canonicalCandidate).isFile()) {
+                throw new SessionPathError("Session path is not a file", "invalid");
+            }
+        }
+        catch (error) {
+            if (error instanceof SessionPathError)
+                throw error;
+            if (errorCode(error) === "ENOENT" || errorCode(error) === "ENOTDIR") {
+                throw new SessionPathError("Session file not found", "not_found");
+            }
+            throw new SessionPathError("Invalid session path", "invalid");
+        }
+        return canonicalCandidate;
+    }
+    /**
+     * Canonicalizes a path allocated by Pi before Pi has flushed the new file.
+     * Its existing parent is still resolved so a symlinked directory cannot escape.
+     */
+    resolvePending(value) {
+        const candidate = this.resolveLexical(value);
+        try {
+            return this.resolveExisting(candidate);
+        }
+        catch (error) {
+            if (!(error instanceof SessionPathError) || error.code !== "not_found")
+                throw error;
+        }
+        const canonicalRoot = this.resolveRoot();
+        let canonicalParent;
+        try {
+            canonicalParent = realpathSync(path.dirname(candidate));
+        }
+        catch {
+            throw new SessionPathError("Session parent directory not found", "not_found");
+        }
+        if (canonicalParent !== canonicalRoot && !isWithin(canonicalRoot, canonicalParent)) {
+            throw new SessionPathError("Session path escapes the Pi sessions directory", "invalid");
+        }
+        try {
+            if (!statSync(canonicalParent).isDirectory()) {
+                throw new SessionPathError("Invalid session parent directory", "invalid");
+            }
+        }
+        catch (error) {
+            if (error instanceof SessionPathError)
+                throw error;
+            throw new SessionPathError("Invalid session parent directory", "invalid");
+        }
+        return path.join(canonicalParent, path.basename(candidate));
+    }
+    /** Returns a confined, canonical destination for a server-generated filename. */
+    createPath(filename) {
+        if (!filename || path.basename(filename) !== filename || path.extname(filename) !== ".jsonl") {
+            throw new SessionPathError("Invalid generated session filename", "invalid");
+        }
+        const canonicalRoot = this.resolveRoot();
+        const candidate = path.join(canonicalRoot, filename);
+        if (!isWithin(canonicalRoot, candidate)) {
+            throw new SessionPathError("Generated session path escapes the Pi sessions directory", "invalid");
+        }
+        return candidate;
+    }
+    resolveLexical(value) {
+        if (typeof value !== "string" || !value || value.includes("\0")) {
+            throw new SessionPathError("Missing or invalid session path", "invalid");
+        }
+        if (!path.isAbsolute(value)) {
+            throw new SessionPathError("Session path must be absolute", "invalid");
+        }
+        const candidate = path.resolve(value);
+        if (path.extname(candidate) !== ".jsonl" || !isWithin(this.configuredRoot, candidate)) {
+            throw new SessionPathError("Session path must be a .jsonl file within the Pi sessions directory", "invalid");
+        }
+        return candidate;
+    }
+    resolveRoot() {
+        let canonicalRoot;
+        try {
+            canonicalRoot = realpathSync(this.configuredRoot);
+        }
+        catch (error) {
+            if (errorCode(error) === "ENOENT" || errorCode(error) === "ENOTDIR") {
+                throw new SessionPathError("Pi sessions directory not found", "not_found");
+            }
+            throw new SessionPathError("Invalid Pi sessions directory", "invalid");
+        }
+        try {
+            if (!statSync(canonicalRoot).isDirectory()) {
+                throw new SessionPathError("Invalid Pi sessions directory", "invalid");
+            }
+        }
+        catch (error) {
+            if (error instanceof SessionPathError)
+                throw error;
+            throw new SessionPathError("Invalid Pi sessions directory", "invalid");
+        }
+        return canonicalRoot;
+    }
+}

package/dist/server/server/update-api.js

@@ -0,0 +1,28 @@
+import { isUpdateTarget } from "../shared/updates.js";
+export function registerUpdateApi(app, manager) {
+    app.get("/api/updates", async (_req, res) => {
+        try {
+            res.json(await manager.check());
+        }
+        catch (error) {
+            res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
+        }
+    });
+    app.post("/api/updates/:target", async (req, res) => {
+        if (req.get("X-Pipane-Action") !== "update") {
+            res.status(400).json({ error: "Missing update action header." });
+            return;
+        }
+        if (!isUpdateTarget(req.params.target)) {
+            res.status(400).json({ error: `Unknown update target: ${req.params.target}` });
+            return;
+        }
+        try {
+            const result = await manager.run(req.params.target);
+            res.json({ result, snapshot: manager.currentSnapshot });
+        }
+        catch (error) {
+            res.status(409).json({ error: error instanceof Error ? error.message : String(error) });
+        }
+    });
+}

package/dist/server/server/update-check.js

@@ -1,24 +1,44 @@
-/**
- * Check the npm registry for the latest version of a package.
- * Returns null if the check fails (network error, timeout, etc.)
- */
-export async function fetchLatestVersion(packageName, timeoutMs = 3000) {
+async function fetchJson(url, timeoutMs, headers) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), timeoutMs);
-        const res = await fetch(`https://registry.npmjs.org/${packageName}/latest`, {
+        const response = await fetch(url, {
             signal: controller.signal,
-            headers: { Accept: "application/json" },
+            headers,
         });
-        clearTimeout(timer);
-        if (!res.ok)
+        if (!response.ok)
             return null;
-        const data = (await res.json());
-        return data.version ?? null;
+        return await response.json();
     }
     catch {
         return null;
     }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Check the npm registry for the latest version of a package. */
+export async function fetchLatestVersion(packageName, timeoutMs = 3000) {
+    const data = await fetchJson(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`, timeoutMs, { Accept: "application/json" });
+    return typeof data?.version === "string" && data.version.trim() ? data.version.trim() : null;
+}
+/** Check Pi's release endpoint, including package migration metadata. */
+export async function fetchLatestPiRelease(currentVersion, timeoutMs = 3000) {
+    const data = await fetchJson("https://pi.dev/api/latest-version", timeoutMs, {
+        Accept: "application/json",
+        "User-Agent": `pipane/${currentVersion}`,
+    });
+    if (typeof data?.version !== "string" || !data.version.trim())
+        return null;
+    return {
+        version: data.version.trim(),
+        ...(typeof data.packageName === "string" && data.packageName.trim()
+            ? { packageName: data.packageName.trim() }
+            : {}),
+        ...(typeof data.note === "string" && data.note.trim()
+            ? { note: data.note.trim() }
+            : {}),
+    };
 }
 /**
  * Compare two semver strings. Returns:

package/dist/server/server/update-manager.js

@@ -0,0 +1,231 @@
+import { spawn } from "node:child_process";
+import { DefaultPackageManager, SettingsManager, getAgentDir, } from "@earendil-works/pi-coding-agent";
+import { compareSemver, fetchLatestPiRelease, fetchLatestVersion, } from "./update-check.js";
+const UPDATE_COMMAND_TIMEOUT_MS = 10 * 60_000;
+const MAX_COMMAND_OUTPUT = 16 * 1024;
+const NO_UPDATE_MESSAGES = {
+    pipane: "pipane is already up to date.",
+    pi: "Pi is already up to date.",
+    extensions: "Pi packages are already up to date.",
+};
+function appendBounded(current, chunk) {
+    const next = current + chunk.toString();
+    return next.length > MAX_COMMAND_OUTPUT ? next.slice(-MAX_COMMAND_OUTPUT) : next;
+}
+export function runUpdateCommand(command, args, cwd, timeoutMs = UPDATE_COMMAND_TIMEOUT_MS) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, {
+            cwd,
+            env: process.env,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        let settled = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+        }, timeoutMs);
+        child.stdout?.on("data", (chunk) => { stdout = appendBounded(stdout, chunk); });
+        child.stderr?.on("data", (chunk) => { stderr = appendBounded(stderr, chunk); });
+        child.on("error", (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(new Error(`Failed to start ${command}: ${error.message}`));
+        });
+        child.on("close", (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (timedOut) {
+                reject(new Error(`Update command timed out after ${Math.round(timeoutMs / 1000)} seconds.`));
+                return;
+            }
+            if (code !== 0) {
+                const detail = (stderr || stdout).trim();
+                const suffix = detail ? `: ${detail}` : signal ? ` (signal ${signal})` : "";
+                reject(new Error(`Update command failed with exit code ${code ?? "unknown"}${suffix}`));
+                return;
+            }
+            resolve({ stdout: stdout.trim(), stderr: stderr.trim() });
+        });
+    });
+}
+async function getInstalledPiVersion(launch, cwd) {
+    try {
+        const result = await runUpdateCommand(launch.command, [...launch.baseArgs, "--version"], cwd, 10_000);
+        const match = `${result.stdout}\n${result.stderr}`.match(/\bv?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b/);
+        return match?.[1] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function checkManagedExtensionUpdates(cwd) {
+    if (process.env.PI_OFFLINE)
+        return [];
+    const agentDir = getAgentDir();
+    // RPC mode does not prompt for project trust. Check the user-level package set,
+    // which is shared by every Pi worker, without loading untrusted project config.
+    const settingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted: false });
+    const packageManager = new DefaultPackageManager({ cwd, agentDir, settingsManager });
+    const updates = await packageManager.checkForAvailableUpdates();
+    return updates.map((update) => update.displayName);
+}
+function cloneSnapshot(snapshot) {
+    return {
+        checkedAt: snapshot.checkedAt,
+        notices: snapshot.notices.map((notice) => ({
+            ...notice,
+            ...(notice.packages ? { packages: [...notice.packages] } : {}),
+        })),
+    };
+}
+export class UpdateManager {
+    options;
+    dependencies;
+    snapshot = { checkedAt: new Date(0).toISOString(), notices: [] };
+    checkPromise;
+    activeUpdate;
+    constructor(options) {
+        this.options = options;
+        this.dependencies = {
+            fetchLatestVersion,
+            fetchLatestPiRelease,
+            getPiVersion: getInstalledPiVersion,
+            checkExtensionUpdates: checkManagedExtensionUpdates,
+            runCommand: runUpdateCommand,
+            ...options.dependencies,
+        };
+    }
+    get currentSnapshot() {
+        return cloneSnapshot(this.snapshot);
+    }
+    check() {
+        if (!this.checkPromise) {
+            this.checkPromise = this.performCheck();
+        }
+        return this.checkPromise.then(cloneSnapshot);
+    }
+    async performCheck() {
+        if (this.options.skipChecks || process.env.PIPANE_SKIP_UPDATE_CHECK || process.env.PI_OFFLINE) {
+            this.snapshot = { checkedAt: new Date().toISOString(), notices: [] };
+            return this.snapshot;
+        }
+        const pipaneCheck = this.checkPipaneUpdate();
+        const piCheck = process.env.PI_SKIP_VERSION_CHECK
+            ? Promise.resolve(null)
+            : this.checkPiUpdate();
+        const extensionCheck = this.checkExtensionUpdate();
+        const notices = (await Promise.all([pipaneCheck, piCheck, extensionCheck]))
+            .filter((notice) => notice !== null);
+        this.snapshot = { checkedAt: new Date().toISOString(), notices };
+        return this.snapshot;
+    }
+    async checkPipaneUpdate() {
+        try {
+            const latestVersion = await this.dependencies.fetchLatestVersion(this.options.pipanePackageName);
+            if (!latestVersion || compareSemver(this.options.pipaneVersion, latestVersion) >= 0)
+                return null;
+            return {
+                target: "pipane",
+                currentVersion: this.options.pipaneVersion,
+                latestVersion,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    async checkPiUpdate() {
+        try {
+            const currentVersion = await this.dependencies.getPiVersion(this.options.piLaunch, this.options.cwd);
+            if (!currentVersion)
+                return null;
+            const release = await this.dependencies.fetchLatestPiRelease(currentVersion);
+            if (!release || compareSemver(currentVersion, release.version) >= 0)
+                return null;
+            return {
+                target: "pi",
+                currentVersion,
+                latestVersion: release.version,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    async checkExtensionUpdate() {
+        try {
+            const packages = [...new Set(await this.dependencies.checkExtensionUpdates(this.options.cwd))]
+                .sort((left, right) => left.localeCompare(right));
+            return packages.length > 0 ? { target: "extensions", packages } : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async run(target) {
+        await this.check();
+        if (this.activeUpdate) {
+            throw new Error(`An update is already running for ${this.activeUpdate}.`);
+        }
+        const notice = this.snapshot.notices.find((candidate) => candidate.target === target);
+        if (!notice) {
+            return {
+                target,
+                message: NO_UPDATE_MESSAGES[target],
+                restartRequired: false,
+            };
+        }
+        this.activeUpdate = target;
+        try {
+            const result = await this.performUpdate(notice);
+            this.snapshot = {
+                checkedAt: new Date().toISOString(),
+                notices: this.snapshot.notices.filter((candidate) => candidate.target !== target),
+            };
+            return result;
+        }
+        finally {
+            this.activeUpdate = undefined;
+        }
+    }
+    async performUpdate(notice) {
+        switch (notice.target) {
+            case "pipane": {
+                if (!notice.latestVersion)
+                    throw new Error("The pipane update has no target version.");
+                await this.dependencies.runCommand("npm", ["install", "-g", "--ignore-scripts", `${this.options.pipanePackageName}@${notice.latestVersion}`], this.options.cwd);
+                return {
+                    target: "pipane",
+                    message: `pipane v${notice.latestVersion} installed. Restart pipane to use the new version.`,
+                    restartRequired: true,
+                };
+            }
+            case "pi": {
+                await this.dependencies.runCommand(this.options.piLaunch.command, [...this.options.piLaunch.baseArgs, "update", "--self"], this.options.cwd);
+                await this.options.onPiRuntimeChanged?.();
+                return {
+                    target: "pi",
+                    message: `Pi${notice.latestVersion ? ` v${notice.latestVersion}` : ""} installed. Pi workers are restarting.`,
+                    restartRequired: false,
+                };
+            }
+            case "extensions": {
+                await this.dependencies.runCommand(this.options.piLaunch.command, [...this.options.piLaunch.baseArgs, "update", "--extensions"], this.options.cwd);
+                await this.options.onPiRuntimeChanged?.();
+                const count = notice.packages?.length ?? 0;
+                return {
+                    target: "extensions",
+                    message: `${count} Pi package${count === 1 ? "" : "s"} updated. Pi workers are restarting.`,
+                    restartRequired: false,
+                };
+            }
+        }
+    }
+}