pipane 0.1.8 → 0.1.10

package/dist/server/server/ws-handler.js

@@ -8,7 +8,7 @@
  * - Any number of clients can connect; each subscribes to one session at a time.
  * - Detached sessions are read from JSONL on demand.
  */
-import { FRAME_CONNECTION_OPEN } from "./frame-connection.js";
+import { FRAME_CONNECTION_OPEN, WebSocketFrameConnection, } from "./frame-connection.js";
 import { copyFile } from "node:fs/promises";
 import { constants as fsConstants, existsSync } from "node:fs";
 import path from "node:path";
@@ -16,10 +16,13 @@ import { SessionJsonl, readSessionFromDisk, getSessionFileSize, serializeSession
 import { getSessionCwd } from "./session-cwd.js";
 import { checkCommandAvailable, installPiGlobal, isPiInstallable, makePiNotFoundMessage } from "./pi-runtime.js";
 import { modelsMatch, toCompactModelRef } from "../shared/thinking-levels.js";
+import { computeSyncOp } from "../shared/jsonl-sync.js";
 import { COMPACT_RPC_TIMEOUT_MS } from "../shared/rpc-timeouts.js";
 import { assertNever, decodeClientCommand, encodeServerMessage, } from "../shared/ws-protocol.js";
 import { SessionPathError, SessionPathGuard } from "./session-path.js";
 import { extensionStatusSnapshot, isValidExtensionStatusKey, normalizeExtensionStatusText, providerForUsageStatus, PROVIDER_USAGE_STATUS_KEY, } from "./extension-status.js";
+const DETACHED_SYNC_COALESCE_MS = 75;
+const SESSION_SYNC_TRANSFER_KEY = "active-session-sync";
 let nextTurnId = 0;
 function makeTurnId() {
     return `turn_${Date.now()}_${++nextTurnId}`;
@@ -49,6 +52,8 @@ export class WsHandler {
     subscribedFileSizes = new Map();
     /** Last revision/hash published for each authoritative session state. */
     sessionRevisions = new Map();
+    /** Per-session trailing-edge disk refreshes for detached JSONL bursts. */
+    pendingDetachedSyncs = new Map();
     piAvailable;
     piInstalling = false;
     constructor(options) {
@@ -186,29 +191,36 @@ export class WsHandler {
     }
     /**
      * Called by the file watcher when a JSONL file changes on disk.
-     * For detached sessions with subscribers, re-reads from disk and pushes a snapshot.
-     * Ignores attached sessions (their state comes from streaming events).
+     * Detached writes are coalesced per session so a burst is read, diffed, and
+     * published once at its trailing edge. Attached actor events remain authoritative.
      */
     notifySessionFileChanged(sessionPath) {
-        // If the session is attached, ignore — streaming events are authoritative
-        if (this.registry.find(sessionPath)?.isAttached)
+        if (this.registry.find(sessionPath)?.isAttached || !this.hasSubscribers(sessionPath))
             return;
-        // Check if any client is subscribed to this session
-        let hasSubscribers = false;
-        for (const [, client] of this.clients) {
-            if (client.subscribedSession === sessionPath) {
-                hasSubscribers = true;
-                break;
-            }
+        const pending = this.pendingDetachedSyncs.get(sessionPath);
+        if (pending)
+            clearTimeout(pending);
+        const timer = setTimeout(() => {
+            this.pendingDetachedSyncs.delete(sessionPath);
+            this.flushDetachedSessionSync(sessionPath);
+        }, DETACHED_SYNC_COALESCE_MS);
+        timer.unref?.();
+        this.pendingDetachedSyncs.set(sessionPath, timer);
+    }
+    hasSubscribers(sessionPath) {
+        for (const client of this.clients.values()) {
+            if (client.subscribedSession === sessionPath)
+                return true;
         }
-        if (!hasSubscribers)
+        return false;
+    }
+    flushDetachedSessionSync(sessionPath) {
+        if (this.registry.find(sessionPath)?.isAttached || !this.hasSubscribers(sessionPath))
             return;
-        // Check if the file actually changed
         const oldSize = this.subscribedFileSizes.get(sessionPath) ?? 0;
         const newSize = getSessionFileSize(sessionPath);
         if (newSize === oldSize)
             return;
-        // File changed — read from disk and push snapshot to subscribers
         this.subscribedFileSizes.set(sessionPath, newSize);
         const { json, hash } = readSessionFromDisk(sessionPath);
         this.pushSnapshotToSubscribers(sessionPath, json, hash);
@@ -243,7 +255,7 @@ export class WsHandler {
                 ws.close(1008, "Unauthorized");
                 return;
             }
-            this.acceptConnection(ws);
+            this.acceptConnection(new WebSocketFrameConnection(ws));
         });
     }
     acceptAuthenticatedConnection(connection) {
@@ -279,8 +291,11 @@ export class WsHandler {
         });
     }
     sendMessage(ws, payload) {
-        if (ws.readyState === FRAME_CONNECTION_OPEN)
-            ws.send(encodeServerMessage(payload));
+        if (ws.readyState !== FRAME_CONNECTION_OPEN)
+            return;
+        ws.send(encodeServerMessage(payload), payload.type === "session_sync"
+            ? { priority: "bulk", transferKey: SESSION_SYNC_TRANSFER_KEY }
+            : { priority: "control" });
     }
     sendSuccess(ws, id, command, data) {
         this.sendMessage(ws, {
@@ -417,6 +432,7 @@ export class WsHandler {
             return;
         const requestedPath = command.sessionPath;
         if (!requestedPath) {
+            ws.cancelTransfer?.(SESSION_SYNC_TRANSFER_KEY);
             client.subscribedSession = null;
             client.lastVersion = 0;
             client.lastJson = "";
@@ -438,7 +454,13 @@ export class WsHandler {
                 throw error;
             sessionPath = pendingPath;
         }
+        // A newly selected session makes every queued chunk from the previous
+        // snapshot stale. The carrier emits a cancellation for a partial frame.
+        ws.cancelTransfer?.(SESSION_SYNC_TRANSFER_KEY);
         client.subscribedSession = sessionPath;
+        client.lastVersion = 0;
+        client.lastJson = "";
+        client.lastHash = "";
         // If the session is attached, send from its actor-owned in-memory state
         const attached = this.registry.find(sessionPath)?.session;
         if (attached) {
@@ -1083,17 +1105,16 @@ export class WsHandler {
     pushSnapshotToSubscribers(sessionPath, json, hash) {
         const revision = this.revisionForState(sessionPath, hash);
         for (const [ws, client] of this.clients) {
-            if (client.subscribedSession !== sessionPath)
+            if (client.subscribedSession !== sessionPath || ws.readyState !== FRAME_CONNECTION_OPEN)
                 continue;
-            if (ws.readyState !== FRAME_CONNECTION_OPEN)
+            if (client.lastHash === hash)
                 continue;
+            const sync = computeSyncOp(client.lastJson, json, client.lastHash, hash);
             this.sendMessage(ws, {
                 type: "session_sync",
                 sessionPath,
                 revision,
-                op: "full",
-                data: json,
-                hash,
+                ...sync,
             });
             client.lastJson = json;
             client.lastHash = hash;

package/dist/server/shared/data-channel-framing.js

@@ -1,5 +1,7 @@
 const CHUNK_MARKER = 1;
+const CANCEL_MARKER = 1;
 const CHUNK_PREFIX = `{"__pipaneDataChannelChunk":${CHUNK_MARKER},`;
+const CANCEL_PREFIX = `{"__pipaneDataChannelCancel":${CANCEL_MARKER},`;
 /** Keep physical messages below conservative browser/libdatachannel SCTP limits. */
 export const DATA_CHANNEL_CHUNK_PAYLOAD_BYTES = 12_000;
 export const MAX_DATA_CHANNEL_MESSAGE_BYTES = 16 * 1024;
@@ -41,13 +43,23 @@ export function encodeDataChannelFrame(frame, id) {
     }
     return messages;
 }
+/** Cancel one incomplete logical frame without exposing a carrier envelope upstream. */
+export function encodeDataChannelFrameCancellation(id) {
+    if (!CHUNK_ID_PATTERN.test(id))
+        throw new Error("DataChannel frame id is invalid");
+    return JSON.stringify({ __pipaneDataChannelCancel: CANCEL_MARKER, id });
+}
 /** Reassemble carrier chunks while passing ordinary application frames through unchanged. */
 export class DataChannelFrameDecoder {
     pending = new Map();
     accept(message) {
-        if (!message.startsWith(CHUNK_PREFIX))
+        if (!message.startsWith(CHUNK_PREFIX) && !message.startsWith(CANCEL_PREFIX))
             return message;
         try {
+            if (message.startsWith(CANCEL_PREFIX)) {
+                this.pending.delete(parseCancel(message).id);
+                return undefined;
+            }
             const chunk = parseChunk(message);
             let pending = this.pending.get(chunk.id);
             if (!pending) {
@@ -90,6 +102,24 @@ export class DataChannelFrameDecoder {
         this.pending.clear();
     }
 }
+function parseCancel(message) {
+    let value;
+    try {
+        value = JSON.parse(message);
+    }
+    catch {
+        throw new Error("DataChannel cancellation is not valid JSON");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("DataChannel cancellation must be an object");
+    }
+    const cancellation = value;
+    if (cancellation.__pipaneDataChannelCancel !== CANCEL_MARKER
+        || typeof cancellation.id !== "string" || !CHUNK_ID_PATTERN.test(cancellation.id)) {
+        throw new Error("DataChannel cancellation envelope is invalid");
+    }
+    return cancellation;
+}
 function parseChunk(message) {
     let value;
     try {

package/docs/protocol.md

@@ -52,7 +52,7 @@ The server sends a fresh random `challenge`. A backend responds with `register_b
 
 The backend client reconnects its outbound WebSocket with bounded exponential backoff and repeats challenge authentication. STUN servers may be static. TURN credentials use coturn's REST convention: an expiring `timestamp:subject` username and HMAC-SHA1 credential; fresh backend credentials accompany each `connection_request` rather than expiring in a long-running peer manager. Browser and backend support relay-only ICE policy; deterministic E2E forces both peers through a local UDP TURN relay.
 
-Backend registration uses `PIPANE_RENDEZVOUS_URL` and optional `PIPANE_APP_URL`/`PIPANE_BACKEND_NAME`. The rendezvous executable reads comma-separated `PIPANE_STUN_URLS` and `PIPANE_TURN_URLS`, plus `PIPANE_TURN_SECRET`; durable central identity/account state defaults to `~/.config/pipane-rendezvous` or `PIPANE_RENDEZVOUS_DATA_DIR`.
+Backends register with `https://pipane.dev` by default. `PIPANE_RENDEZVOUS_URL` overrides that endpoint (or disables registration when set to an empty value), while `PIPANE_APP_URL` optionally overrides generated browser links. `PIPANE_BACKEND_NAME` is optional and defaults to the machine's non-fully-qualified hostname. The rendezvous executable reads comma-separated `PIPANE_STUN_URLS` and `PIPANE_TURN_URLS`, plus `PIPANE_TURN_SECRET`; durable central identity/account state defaults to `~/.config/pipane-rendezvous` or `PIPANE_RENDEZVOUS_DATA_DIR`.
 
 ### Device identity and anonymous accounts
 
@@ -89,7 +89,9 @@ The answer-side implementation accepts only a reliable ordered DataChannel with
 
 Authenticated DataChannels carry the existing versioned v1 application frames through the same server connection boundary as local WebSockets. A frame router keeps those application frames isolated from semantic v2 responses on the same ordered channel. Revocation closes active rendezvous routes and matching backend peers, prevents new ticket issuance, and is retained centrally so an offline backend clears stale local ownership when it next registers.
 
-After the unfragmented authentication exchange, the carrier transparently splits logical frames larger than 12,000 UTF-8 bytes into ordered base64 chunk envelopes no larger than 16 KiB. Browser and backend reassemble at most 64 MiB per logical frame with bounded pending-frame and outgoing-queue memory. Application v1 and semantic v2 decoders therefore continue to receive exactly one complete JSON frame regardless of the negotiated SCTP message-size limit.
+After the unfragmented authentication exchange, the carrier transparently splits logical frames larger than 12,000 UTF-8 bytes into ordered base64 chunk envelopes no larger than 16 KiB. The same transparent envelopes are used for large server-to-browser local WebSocket frames. Browser and backend reassemble at most 64 MiB per logical frame with bounded pending-frame and outgoing-queue memory. Application v1 and semantic v2 decoders therefore continue to receive exactly one complete JSON frame regardless of the negotiated SCTP message-size limit.
+
+Server carriers schedule control and bulk lanes independently, so responses, status, steering, and abort traffic can overtake queued session-snapshot chunks. Selecting another session cancels the unsent portion of the stale snapshot with a reserved carrier envelope before the replacement begins. Detached JSONL watcher bursts are coalesced per session and hash-chained against each client's last state, producing a delta when it is smaller than a full snapshot and suppressing unchanged updates.
 
 ### Semantic backend protocol v2
 
@@ -112,7 +114,7 @@ The currently implemented semantic methods are:
 
 Every method has runtime-validated parameters, correlated responses, stable error codes, bounded concurrency, and a bounded device-scoped completed-request cache. File uploads use bounded, offset-addressed base64 chunks so arbitrary non-image attachments can cross either local HTTP or the authenticated DataChannel, land in a private temporary backend path, and be referenced in the agent prompt. Pending browser requests retain their id across a carrier reconnect, so an in-flight mutation is resumed or answered from the cache instead of being executed twice. The backend uses one `LocalBackendApi` implementation for both the legacy local HTTP facade and semantic DataChannel requests. Remote session results are scoped to a structured `{ backendId, path }` identity; paths remain backend-local identifiers rather than authorization.
 
-The browser's `RemoteBackendManager` maintains one client/store per active backend id, requests a fresh ticket whenever a WebRTC carrier reconnects, and never treats an arbitrary URL backend id as authorized until signed account discovery includes it. The product UI exposes reachable authorized backends and uses on-demand pairwise connections rather than a full mesh. Terminal `pipane pair` remains the no-email recovery path when browser storage is lost.
+The browser's `RemoteBackendManager` maintains one client/store per authorized backend id, requests a fresh ticket whenever a WebRTC carrier reconnects, and never treats an arbitrary URL backend id as authorized until signed account discovery includes it. The account workspace opens a direct connection to each reachable authorized host so it can merge backend-scoped session metadata and live status in one sidebar; only the selected host/session drives the conversation renderer and receives a session subscription. Session metadata remains end-to-end between browser and backend and is not indexed by rendezvous. Terminal `pipane pair` remains the no-email recovery path when browser storage is lost.
 
 Application streaming, turn control, and session snapshots remain on validated v1 frames during parity migration. Semantic v2 is deployed beside v1 rather than changing v1's renderer-state contract in place.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pipane",
-	"version": "0.1.8",
+	"version": "0.1.10",
 	"description": "A clean web interface for the pi coding agent — chat UI with real-time tool calls, streaming output, session management, and model picker",
 	"private": false,
 	"type": "module",

package/dist/client/assets/backend-landing-page-B7SbyIXQ.js

@@ -1 +0,0 @@
-import{B as u}from"./__vite-browser-external-DtLbhLGx.js";import{R as x,a as b}from"./rendezvous-trust-api-C2Zob5i4.js";const y={loadIdentity:()=>b(),createTrustApi:()=>new x(window.location.origin),confirm:e=>window.confirm(e)};async function v(e=y){const l=document.getElementById("app")??document.body;l.replaceChildren();const r=document.createElement("main");r.dataset.testid="backend-landing",r.style.cssText="min-height:100vh;padding:40px 24px;font-family:ui-sans-serif,system-ui;color:var(--foreground,#111827);background:var(--background,#fff)";const i=document.createElement("section");i.style.cssText="width:min(760px,100%);margin:0 auto";const t=document.createElement("h1");t.textContent="Your pipane backends",t.style.cssText="margin:0 0 8px;font-size:28px";const s=document.createElement("p");s.textContent="Connections are opened directly and only when you choose a backend.",s.style.cssText="margin:0 0 24px;opacity:.72";const n=document.createElement("div");n.dataset.testid="backend-list",n.style.cssText="display:grid;gap:12px";const d=document.createElement("p");d.style.cssText="margin-top:24px;padding-top:18px;border-top:1px solid var(--border,#d1d5db);opacity:.78;line-height:1.5",d.textContent="Add a backend or recover this browser by running `pipane pair` in an owned backend terminal and scanning its QR code.",i.append(t,s,n,d),r.append(i),l.append(r);const c=await e.loadIdentity();if(!c){n.append(m("No paired browser key was found.","Use `pipane pair` on a backend to begin without creating an account."));return}const o=e.createTrustApi();let a;try{a=await o.listAuthorizedBackends(c)}catch(p){n.append(m("Backend access could not be recovered from this device key.",p instanceof Error?p.message:"Pair this browser again from an owned backend terminal."));return}if(a.length===0){n.append(m("No backends are paired.","Run `pipane pair` in a backend terminal to add one."));return}for(const p of a)n.append(f(p,c,o,e))}function f(e,l,r,i){const t=document.createElement("article");t.dataset.backendId=e.backendId,t.style.cssText="display:flex;align-items:center;gap:14px;border:1px solid var(--border,#d1d5db);border-radius:10px;padding:16px";const s=document.createElement("div");s.style.cssText="min-width:0;flex:1";const n=document.createElement("strong");n.textContent=e.name||`${e.backendId.slice(0,18)}…`,n.style.cssText="display:block;white-space:nowrap;overflow:hidden;text-overflow:ellipsis";const d=document.createElement("small"),c=e.protocolVersions.includes(u);d.textContent=e.online?c?`Online${e.softwareVersion?` · v${e.softwareVersion}`:""}`:"Online · update required":"Offline",d.style.cssText=`color:${e.online&&c?"#15803d":"#a16207"}`,s.append(n,d);const o=document.createElement("a");o.textContent="Open",o.href=`/backend/${encodeURIComponent(e.backendId)}`,o.dataset.testid="open-backend",o.style.cssText="border-radius:8px;padding:8px 12px;background:#2563eb;color:white;text-decoration:none",(!e.online||!c)&&(o.removeAttribute("href"),o.setAttribute("aria-disabled","true"),o.style.opacity=".45");const a=document.createElement("button");return a.type="button",a.textContent="Remove",a.style.cssText="border:0;background:transparent;color:#dc2626;cursor:pointer",a.addEventListener("click",()=>{i.confirm(`Remove ${e.name||e.backendId} from this account?`)&&(a.disabled=!0,r.revokeBackend(l,e.backendId).then(()=>t.remove()).catch(p=>{a.disabled=!1,d.textContent=p instanceof Error?p.message:"Removal failed",d.style.color="#dc2626"}))}),t.append(s,o,a),t}function m(e,l){const r=document.createElement("div");r.style.cssText="border:1px solid var(--border,#d1d5db);border-radius:10px;padding:18px;line-height:1.5";const i=document.createElement("strong");i.textContent=e;const t=document.createElement("p");return t.textContent=l,t.style.cssText="margin:6px 0 0;opacity:.72",r.append(i,t),r}export{v as initializeBackendLandingPage};

package/dist/client/assets/index-C7_1ODks.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/pairing-page-C0YByC2D.js","assets/rendezvous-trust-api-C2Zob5i4.js","assets/webrtc-frame-transport-DGX5EO_A.js","assets/backend-landing-page-B7SbyIXQ.js","assets/__vite-browser-external-DtLbhLGx.js","assets/remote-backend-manager-DCSdS38m.js","assets/ws-agent-adapter-DpkkZGPl.js","assets/main-DEfSB8wO.js","assets/app-runtime-Rw-O-AwW.js"])))=>i.map(i=>d[i]);
-(function(){const e=document.createElement("link").relList;if(e&&e.supports&&e.supports("modulepreload"))return;for(const t of document.querySelectorAll('link[rel="modulepreload"]'))a(t);new MutationObserver(t=>{for(const r of t)if(r.type==="childList")for(const i of r.addedNodes)i.tagName==="LINK"&&i.rel==="modulepreload"&&a(i)}).observe(document,{childList:!0,subtree:!0});function o(t){const r={};return t.integrity&&(r.integrity=t.integrity),t.referrerPolicy&&(r.referrerPolicy=t.referrerPolicy),t.crossOrigin==="use-credentials"?r.credentials="include":t.crossOrigin==="anonymous"?r.credentials="omit":r.credentials="same-origin",r}function a(t){if(t.ep)return;t.ep=!0;const r=o(t);fetch(t.href,r)}})();const w="modulepreload",y=function(n){return"/"+n},p={},f=function(e,o,a){let t=Promise.resolve();if(o&&o.length>0){let m=function(c){return Promise.all(c.map(l=>Promise.resolve(l).then(u=>({status:"fulfilled",value:u}),u=>({status:"rejected",reason:u}))))};document.getElementsByTagName("link");const i=document.querySelector("meta[property=csp-nonce]"),s=i?.nonce||i?.getAttribute("nonce");t=m(o.map(c=>{if(c=y(c),c in p)return;p[c]=!0;const l=c.endsWith(".css"),u=l?'[rel="stylesheet"]':"";if(document.querySelector(`link[href="${c}"]${u}`))return;const d=document.createElement("link");if(d.rel=l?"stylesheet":w,l||(d.as="script"),d.crossOrigin="",d.href=c,s&&d.setAttribute("nonce",s),document.head.appendChild(d),l)return new Promise((h,g)=>{d.addEventListener("load",h),d.addEventListener("error",()=>g(new Error(`Unable to preload CSS for ${c}`)))})}))}function r(i){const s=new Event("vite:preloadError",{cancelable:!0});if(s.payload=i,window.dispatchEvent(s),!s.defaultPrevented)throw i}return t.then(i=>{for(const s of i||[])s.status==="rejected"&&r(s.reason);return e().catch(r)})};"serviceWorker"in navigator&&navigator.serviceWorker.getRegistrations().then(n=>{for(const e of n)e.unregister()});v();async function v(){if(P(window.location.pathname)){const{initializePairingPage:e}=await f(async()=>{const{initializePairingPage:o}=await import("./pairing-page-C0YByC2D.js");return{initializePairingPage:o}},__vite__mapDeps([0,1,2]));await e();return}if(window.location.pathname==="/"&&await E()){const{initializeBackendLandingPage:e}=await f(async()=>{const{initializeBackendLandingPage:o}=await import("./backend-landing-page-B7SbyIXQ.js");return{initializeBackendLandingPage:o}},__vite__mapDeps([3,4,1]));await e();return}const n=b(window.location.pathname);if(n)try{const[{configureAppRuntime:e},{RemoteBackendManager:o}]=await Promise.all([f(()=>import("./app-runtime-Rw-O-AwW.js"),[]),f(()=>import("./remote-backend-manager-DCSdS38m.js"),__vite__mapDeps([5,4,1,2,6]))]),a=new o(window.location.origin),t=await a.initialize();e({client:a.getClient(n),remote:{backendId:n,backends:t,manager:a}})}catch(e){_(e);return}await f(()=>import("./main-DEfSB8wO.js"),__vite__mapDeps([7,6,4,8]))}async function E(){try{const n=await fetch("/health",{cache:"no-store"});if(!n.ok||!n.headers.get("content-type")?.includes("application/json"))return!1;const e=await n.json();return!!e&&typeof e=="object"&&e.ok===!0}catch{return!1}}function _(n){const e=document.getElementById("app")??document.body;e.replaceChildren();const o=document.createElement("main");o.style.cssText="min-height:100vh;display:grid;place-items:center;padding:24px;font-family:ui-sans-serif,system-ui;color:var(--foreground,#111827);background:var(--background,#fff)";const a=document.createElement("section");a.style.cssText="max-width:520px;border:1px solid var(--border,#d1d5db);border-radius:12px;padding:28px";const t=document.createElement("h1");t.textContent="Cannot open backend";const r=document.createElement("p");r.textContent=n instanceof Error?n.message:"This browser is not authorized for the backend.";const i=document.createElement("p");i.textContent="To restore access, run `pipane pair` in the backend terminal and scan the new QR code with this browser.",a.append(t,r,i),o.append(a),e.append(o)}function P(n){return/^\/pair\/[^/]+$/u.test(n)}function b(n){const e=/^\/backend\/([^/]+)$/u.exec(n);return e?.[1]?decodeURIComponent(e[1]):void 0}export{f as _};