turbollm 1.13.1 → 1.13.3

package/README.md

@@ -299,6 +299,12 @@ the detail:
   set per link — use models only, run a server, or full control — optionally pinned to specific
   models, and revocable at any time from the host. Not yet verified against a real two-machine
   setup, so it stays behind Settings → Experimental.
+- **Remote access** *(experimental, off by default)* — expose TurboLLM to the internet through
+  Cloudflare (Quick or Named tunnel), Tailscale (Serve or Funnel), ngrok, or your own reverse
+  proxy, from Settings → Network & sharing. Enabling it mints a capability-scoped access token —
+  restrict it to chat-only, or also allow loading/unloading models — instead of exposing your
+  regular API key, with a live status chip and one-click stop. Not yet verified
+  against real Cloudflare/Tailscale/ngrok accounts, so it stays behind Settings → Experimental.
 - **Thinking-budget control** — a graduated slider, not just on/off: cap reasoning to a specific
   token count, disable it entirely, or leave it unlimited. Works in Chat and Code alike.
 - **Reasoning-effort control** for models whose own chat template supports it (e.g. Qwen3.8) —
@@ -437,8 +443,9 @@ connected); **Remove** undoes it.
 
 - A **persistent bottom strip** on every screen shows real-time CPU, RAM, GPU and VRAM — values
   and percentages — pulled from `nvidia-smi`, WDDM counters, `rocm-smi`, AMD sysfs, `ioreg`,
-  or `/proc` on Linux. Clicking the bar opens detailed gauges and sparklines in Settings → System.
-  Toggle it off entirely from Settings → General.
+  or `/proc` on Linux. Clicking the bar opens detailed gauges and sparklines in Settings → System,
+  including live **disk I/O** (read/write MB/s) and a **shared/spilled VRAM** figure that shows
+  when a discrete GPU has spilled into system memory. Toggle it off entirely from Settings → General.
 - **Engines → Monitor** puts the live engine log and those same hardware gauges on one
   always-visible split screen, plus a second, LM Studio-style **developer request log**: every
   completion the daemon serves — external API clients, Code sessions, in-app Chat — with

package/dist/{chunk-TIH3B2GZ.js → chunk-HQ76BEUS.js}

@@ -12,11 +12,19 @@ import { EventEmitter as EventEmitter2 } from "events";
 // src/chat/chat-routes.ts
 import { streamSSE } from "hono/streaming";
 
+// src/auth.ts
+import { createHash, randomBytes, randomUUID } from "crypto";
+import { getConnInfo } from "@hono/node-server/conninfo";
+
+// src/remote/access-jwt.ts
+import { createPublicKey, createVerify, verify as cryptoVerify } from "crypto";
+var JWKS_TTL_MS = 60 * 6e4;
+
 // src/net.ts
 import { networkInterfaces } from "os";
 
 // src/config/config.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { cpSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import { dirname, join } from "path";
@@ -34,194 +42,6 @@ function parseReasoningEffort(value) {
   return ALIASES.get(value);
 }
 
-// src/tools/approval-gate.ts
-var pending = /* @__PURE__ */ new Map();
-function waitForToolApproval(key, signal) {
-  return new Promise((resolvePromise) => {
-    const onAbort = () => {
-      pending.delete(key);
-      resolvePromise("deny");
-    };
-    const cleanup = () => {
-      signal.removeEventListener("abort", onAbort);
-    };
-    pending.set(key, {
-      resolve: (decision) => {
-        cleanup();
-        resolvePromise(decision);
-      },
-      cleanup
-    });
-    if (signal.aborted) {
-      onAbort();
-      return;
-    }
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-
-// src/agents/skills.ts
-import { join as join2 } from "path";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, rmSync, readdirSync } from "fs";
-var BUILTIN_SKILLS = [
-  {
-    id: "filesystem",
-    name: "Filesystem",
-    description: "Read files, list directories, glob patterns within the agent's workspace.",
-    instructions: "You can read files and explore directories. Use read_file to read file contents, list_dir to explore, and glob to find files. Always work within your allowed paths.",
-    tools: ["read_file", "list_dir", "glob"],
-    builtin: true
-  },
-  {
-    id: "web",
-    name: "Web",
-    description: "Search the web and fetch URLs for research.",
-    instructions: "You can search the web using web_search and fetch URLs with fetch_url. Use these to gather current information and research topics.",
-    tools: ["web_search", "fetch_url"],
-    builtin: true
-  },
-  {
-    id: "code",
-    name: "Code",
-    description: "Execute code for computation and data processing.",
-    instructions: "You can run code using run_code. Code execution runs unattended \u2014 ensure your code is correct before running.",
-    tools: ["run_code"],
-    builtin: true
-  },
-  {
-    id: "task-tracking",
-    name: "Task Tracking",
-    description: "Track progress on a task and declare completion.",
-    instructions: "You can track your progress with update_doc and declare a task complete with complete_task. Update the working doc regularly to maintain a clear record of what's done and what's left.",
-    tools: ["update_doc", "complete_task"],
-    builtin: true
-  },
-  {
-    id: "compose",
-    name: "Compose",
-    description: "Delegate work to other agents via call_agent.",
-    instructions: "You can call other agents using call_agent. Use this to delegate specialized sub-tasks to agents with different capabilities.",
-    tools: ["call_agent"],
-    builtin: true
-  },
-  {
-    id: "skill-creator",
-    name: "Skill Creator",
-    description: "Save a reusable skill distilled from this conversation.",
-    instructions: 'Do NOT proactively mention, suggest, or save skills. ONLY when the user EXPLICITLY asks to create or save a skill from this conversation (e.g. "make a skill out of this", "save this as a skill"), call the save_skill tool \u2014 it writes a SKILL.md into the shared library in the background. Never use any external memory, knowledge-graph, or note tool to store skills.',
-    tools: ["save_skill"],
-    builtin: true
-  }
-];
-function toSkillMd(skill) {
-  const fm = [`name: ${skill.name}`, `description: ${oneLine(skill.description)}`];
-  if (skill.tools.length) fm.push(`tools: ${skill.tools.join(", ")}`);
-  return `---
-${fm.join("\n")}
----
-
-${skill.instructions.trim()}
-`;
-}
-function fromSkillMd(id, raw) {
-  const text = raw.replace(/^/, "").replace(/\r\n/g, "\n");
-  const m = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(text);
-  if (!m) return null;
-  const meta = {};
-  for (const line of m[1].split("\n")) {
-    const c = line.indexOf(":");
-    if (c < 0) continue;
-    meta[line.slice(0, c).trim().toLowerCase()] = unquote(line.slice(c + 1).trim());
-  }
-  const name = meta.name?.trim();
-  const instructions = m[2].trim();
-  if (!name || !instructions) return null;
-  const tools = meta.tools ? meta.tools.split(",").map((t) => unquote(t.trim())).filter(Boolean) : [];
-  return { id, name, description: meta.description ?? "", instructions, tools, builtin: false };
-}
-function unquote(s) {
-  return s.replace(/^["']|["']$/g, "").trim();
-}
-function oneLine(s) {
-  return s.replace(/\s*\n\s*/g, " ").trim();
-}
-var SkillStore = class {
-  constructor(dataDir) {
-    this.dataDir = dataDir;
-  }
-  dataDir;
-  get skillsDir() {
-    return join2(this.dataDir, "skills");
-  }
-  list() {
-    const skills = [...BUILTIN_SKILLS];
-    const idSet = new Set(skills.map((s) => s.id));
-    if (!existsSync2(this.skillsDir)) return skills;
-    for (const e of readdirSync(this.skillsDir, { withFileTypes: true })) {
-      let skill = null;
-      let id = "";
-      if (e.isDirectory()) {
-        id = e.name;
-        const md = join2(this.skillsDir, e.name, "SKILL.md");
-        if (existsSync2(md)) skill = this.loadMd(id, md);
-      } else if (e.isFile() && e.name.endsWith(".json")) {
-        id = e.name.slice(0, -5);
-        skill = this.loadJson(join2(this.skillsDir, e.name), id);
-      }
-      if (!skill || !id || idSet.has(id)) continue;
-      idSet.add(id);
-      skills.push(skill);
-    }
-    return skills;
-  }
-  /** Only the user-created (non-builtin) skills, for injection + the library UI. */
-  userSkills() {
-    return this.list().filter((s) => !s.builtin);
-  }
-  get(id) {
-    return this.list().find((s) => s.id === id);
-  }
-  has(id) {
-    return isValidSkillId(id) && existsSync2(join2(this.skillsDir, id, "SKILL.md"));
-  }
-  write(skill) {
-    if (!isValidSkillId(skill.id)) throw new Error(`Invalid skill id: ${skill.id}`);
-    const dir = join2(this.skillsDir, skill.id);
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync2(join2(dir, "SKILL.md"), toSkillMd(skill), "utf8");
-  }
-  delete(id) {
-    if (!isValidSkillId(id)) return;
-    rmSync(join2(this.skillsDir, id), { recursive: true, force: true });
-    const legacy = join2(this.skillsDir, `${id}.json`);
-    if (existsSync2(legacy)) rmSync(legacy);
-  }
-  loadMd(id, path) {
-    try {
-      return fromSkillMd(id, readFileSync2(path, "utf8"));
-    } catch {
-      return null;
-    }
-  }
-  loadJson(path, id) {
-    try {
-      const data = JSON.parse(readFileSync2(path, "utf8"));
-      if (!data.name || typeof data.name !== "string") return null;
-      if (!data.instructions || typeof data.instructions !== "string") return null;
-      return { id, name: data.name, description: data.description || "", instructions: data.instructions, tools: Array.isArray(data.tools) ? data.tools : [], builtin: false };
-    } catch {
-      return null;
-    }
-  }
-};
-function isValidSkillId(id) {
-  return typeof id === "string" && /^[a-z0-9-]{1,64}$/.test(id);
-}
-
-// src/agents/distiller.ts
-import { readFileSync as readFileSync3, readdirSync as readdirSync2, statSync, existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
-
 // src/engines/compat.ts
 var ENGINE_MODEL_ALIAS = "default_model";
 var RAPID_MLX_MODEL_ALIAS = "default";
@@ -257,7 +77,7 @@ async function proxyStream(remote, path, init, signal, fetchImpl = fetch) {
 }
 
 // src/observability/request-log.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 function requestLogConfig(d) {
   return d.store.snapshot().requestLog ?? { enabled: false, captureBodies: false, maxEntries: 500 };
 }
@@ -476,9 +296,193 @@ function callChatUpstream(upstream, body, signal, fetchImpl = fetch, d) {
   );
 }
 
-// src/auth.ts
-import { createHash, randomBytes, randomUUID as randomUUID3 } from "crypto";
-import { getConnInfo } from "@hono/node-server/conninfo";
+// src/tools/approval-gate.ts
+var pending = /* @__PURE__ */ new Map();
+function waitForToolApproval(key, signal) {
+  return new Promise((resolvePromise) => {
+    const onAbort = () => {
+      pending.delete(key);
+      resolvePromise("deny");
+    };
+    const cleanup = () => {
+      signal.removeEventListener("abort", onAbort);
+    };
+    pending.set(key, {
+      resolve: (decision) => {
+        cleanup();
+        resolvePromise(decision);
+      },
+      cleanup
+    });
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+// src/agents/skills.ts
+import { join as join2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, rmSync, readdirSync } from "fs";
+var BUILTIN_SKILLS = [
+  {
+    id: "filesystem",
+    name: "Filesystem",
+    description: "Read files, list directories, glob patterns within the agent's workspace.",
+    instructions: "You can read files and explore directories. Use read_file to read file contents, list_dir to explore, and glob to find files. Always work within your allowed paths.",
+    tools: ["read_file", "list_dir", "glob"],
+    builtin: true
+  },
+  {
+    id: "web",
+    name: "Web",
+    description: "Search the web and fetch URLs for research.",
+    instructions: "You can search the web using web_search and fetch URLs with fetch_url. Use these to gather current information and research topics.",
+    tools: ["web_search", "fetch_url"],
+    builtin: true
+  },
+  {
+    id: "code",
+    name: "Code",
+    description: "Execute code for computation and data processing.",
+    instructions: "You can run code using run_code. Code execution runs unattended \u2014 ensure your code is correct before running.",
+    tools: ["run_code"],
+    builtin: true
+  },
+  {
+    id: "task-tracking",
+    name: "Task Tracking",
+    description: "Track progress on a task and declare completion.",
+    instructions: "You can track your progress with update_doc and declare a task complete with complete_task. Update the working doc regularly to maintain a clear record of what's done and what's left.",
+    tools: ["update_doc", "complete_task"],
+    builtin: true
+  },
+  {
+    id: "compose",
+    name: "Compose",
+    description: "Delegate work to other agents via call_agent.",
+    instructions: "You can call other agents using call_agent. Use this to delegate specialized sub-tasks to agents with different capabilities.",
+    tools: ["call_agent"],
+    builtin: true
+  },
+  {
+    id: "skill-creator",
+    name: "Skill Creator",
+    description: "Save a reusable skill distilled from this conversation.",
+    instructions: 'Do NOT proactively mention, suggest, or save skills. ONLY when the user EXPLICITLY asks to create or save a skill from this conversation (e.g. "make a skill out of this", "save this as a skill"), call the save_skill tool \u2014 it writes a SKILL.md into the shared library in the background. Never use any external memory, knowledge-graph, or note tool to store skills.',
+    tools: ["save_skill"],
+    builtin: true
+  }
+];
+function toSkillMd(skill) {
+  const fm = [`name: ${skill.name}`, `description: ${oneLine(skill.description)}`];
+  if (skill.tools.length) fm.push(`tools: ${skill.tools.join(", ")}`);
+  return `---
+${fm.join("\n")}
+---
+
+${skill.instructions.trim()}
+`;
+}
+function fromSkillMd(id, raw) {
+  const text = raw.replace(/^/, "").replace(/\r\n/g, "\n");
+  const m = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(text);
+  if (!m) return null;
+  const meta = {};
+  for (const line of m[1].split("\n")) {
+    const c = line.indexOf(":");
+    if (c < 0) continue;
+    meta[line.slice(0, c).trim().toLowerCase()] = unquote(line.slice(c + 1).trim());
+  }
+  const name = meta.name?.trim();
+  const instructions = m[2].trim();
+  if (!name || !instructions) return null;
+  const tools = meta.tools ? meta.tools.split(",").map((t) => unquote(t.trim())).filter(Boolean) : [];
+  return { id, name, description: meta.description ?? "", instructions, tools, builtin: false };
+}
+function unquote(s) {
+  return s.replace(/^["']|["']$/g, "").trim();
+}
+function oneLine(s) {
+  return s.replace(/\s*\n\s*/g, " ").trim();
+}
+var SkillStore = class {
+  constructor(dataDir) {
+    this.dataDir = dataDir;
+  }
+  dataDir;
+  get skillsDir() {
+    return join2(this.dataDir, "skills");
+  }
+  list() {
+    const skills = [...BUILTIN_SKILLS];
+    const idSet = new Set(skills.map((s) => s.id));
+    if (!existsSync2(this.skillsDir)) return skills;
+    for (const e of readdirSync(this.skillsDir, { withFileTypes: true })) {
+      let skill = null;
+      let id = "";
+      if (e.isDirectory()) {
+        id = e.name;
+        const md = join2(this.skillsDir, e.name, "SKILL.md");
+        if (existsSync2(md)) skill = this.loadMd(id, md);
+      } else if (e.isFile() && e.name.endsWith(".json")) {
+        id = e.name.slice(0, -5);
+        skill = this.loadJson(join2(this.skillsDir, e.name), id);
+      }
+      if (!skill || !id || idSet.has(id)) continue;
+      idSet.add(id);
+      skills.push(skill);
+    }
+    return skills;
+  }
+  /** Only the user-created (non-builtin) skills, for injection + the library UI. */
+  userSkills() {
+    return this.list().filter((s) => !s.builtin);
+  }
+  get(id) {
+    return this.list().find((s) => s.id === id);
+  }
+  has(id) {
+    return isValidSkillId(id) && existsSync2(join2(this.skillsDir, id, "SKILL.md"));
+  }
+  write(skill) {
+    if (!isValidSkillId(skill.id)) throw new Error(`Invalid skill id: ${skill.id}`);
+    const dir = join2(this.skillsDir, skill.id);
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync2(join2(dir, "SKILL.md"), toSkillMd(skill), "utf8");
+  }
+  delete(id) {
+    if (!isValidSkillId(id)) return;
+    rmSync(join2(this.skillsDir, id), { recursive: true, force: true });
+    const legacy = join2(this.skillsDir, `${id}.json`);
+    if (existsSync2(legacy)) rmSync(legacy);
+  }
+  loadMd(id, path) {
+    try {
+      return fromSkillMd(id, readFileSync2(path, "utf8"));
+    } catch {
+      return null;
+    }
+  }
+  loadJson(path, id) {
+    try {
+      const data = JSON.parse(readFileSync2(path, "utf8"));
+      if (!data.name || typeof data.name !== "string") return null;
+      if (!data.instructions || typeof data.instructions !== "string") return null;
+      return { id, name: data.name, description: data.description || "", instructions: data.instructions, tools: Array.isArray(data.tools) ? data.tools : [], builtin: false };
+    } catch {
+      return null;
+    }
+  }
+};
+function isValidSkillId(id) {
+  return typeof id === "string" && /^[a-z0-9-]{1,64}$/.test(id);
+}
+
+// src/agents/distiller.ts
+import { readFileSync as readFileSync3, readdirSync as readdirSync2, statSync, existsSync as existsSync3 } from "fs";
+import { join as join3 } from "path";
 
 // src/engines/download.ts
 import { createWriteStream, existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
@@ -1597,7 +1601,7 @@ import {
   SettingsManager,
   isEditToolResult
 } from "@earendil-works/pi-coding-agent";
-import { estimateTokens, calculateContextTokens } from "@earendil-works/pi-coding-agent";
+import { estimateTokens as estimateTokens2, calculateContextTokens } from "@earendil-works/pi-coding-agent";
 
 // src/code/robust-bash.ts
 import { access as fsAccess } from "fs/promises";
@@ -3274,12 +3278,12 @@ ${lines.join("\n")}${more}]`
     if (lastUsage) {
       contextUsed = calculateContextTokens(lastUsage);
       for (let i = lastUsageIdx + 1; i < session.messages.length; i++) {
-        contextUsed += estimateTokens(session.messages[i]);
+        contextUsed += estimateTokens2(session.messages[i]);
       }
     } else {
       contextUsed = 0;
       for (const m of session.messages) {
-        contextUsed += estimateTokens(m);
+        contextUsed += estimateTokens2(m);
       }
     }
   }