Merge remote-tracking branch 'origin/main' into review/pr-5-machine-federation-fixes

# Conflicts:
#	src/client/src/api.ts
#	src/client/src/api/clients.ts
#	src/client/src/api/parsers.ts
#	src/client/src/components/PiWebApp.ts
#	src/server/app.ts
#	src/shared/apiTypes.ts

src/server/app.test.ts

@@ -50,6 +50,7 @@ beforeEach(async () => {
     sessionDaemon: fakeSessionDaemon(),
     piWebPlugins: {
       manifest: () => Promise.resolve({ plugins: [{ id: "fake", module: "/pi-web-plugins/fake/plugin.js?v=1", source: "test", scope: "local" }] }),
+      plugins: () => Promise.resolve({ plugins: [{ id: "fake", module: "/pi-web-plugins/fake/plugin.js?v=1", source: "test", scope: "local", enabled: true }] }),
       readAsset: (pluginId, assetPath) => Promise.resolve(pluginId === "fake" && assetPath === "plugin.js" ? { content: Buffer.from("export default {};"), contentType: "application/javascript; charset=utf-8" } : undefined),
     },
     clientDist: false,
@@ -288,6 +289,10 @@ describe("buildApp", () => {
     expect(manifestResponse.statusCode).toBe(200);
     expect(manifestResponse.json()).toEqual({ plugins: [{ id: "fake", module: "/pi-web-plugins/fake/plugin.js?v=1", source: "test", scope: "local" }] });
 
+    const pluginsResponse = await app.inject({ method: "GET", url: "/api/plugins" });
+    expect(pluginsResponse.statusCode).toBe(200);
+    expect(pluginsResponse.json()).toEqual({ plugins: [{ id: "fake", module: "/pi-web-plugins/fake/plugin.js?v=1", source: "test", scope: "local", enabled: true }] });
+
     const assetResponse = await app.inject({ method: "GET", url: "/pi-web-plugins/fake/plugin.js?v=1" });
     expect(assetResponse.statusCode).toBe(200);
     expect(assetResponse.headers["content-type"]).toContain("application/javascript");

src/server/app.ts

@@ -14,6 +14,7 @@ import { registerSessionProxyRoutes, type SessionProxyDaemon } from "./sessiond/
 import { registerWorkspaceExplorerRoutes } from "./workspaceExplorerRoutes.js";
 import { registerGitRoutes } from "./gitRoutes.js";
 import { registerTerminalProxyRoutes } from "./terminalProxyRoutes.js";
+import { registerConfigRoutes, type PiWebConfigService } from "./configRoutes.js";
 import { PiWebPluginService } from "./piWebPluginService.js";
 import { getPiWebStatus, getPiWebVersionStatus } from "./piWebStatus.js";
 import { MachineService } from "./machines/machineService.js";
@@ -25,7 +26,8 @@ export interface AppDependencies {
   workspaces?: WorkspaceService;
   machines?: MachineService;
   sessionDaemon?: SessionProxyDaemon;
-  piWebPlugins?: Pick<PiWebPluginService, "manifest" | "readAsset">;
+  piWebPlugins?: Pick<PiWebPluginService, "manifest" | "plugins" | "readAsset">;
+  config?: PiWebConfigService;
   clientDist?: string | false;
   logger?: FastifyServerOptions["logger"];
 }
@@ -100,6 +102,8 @@ export async function buildApp(deps: AppDependencies = {}): Promise<FastifyInsta
 
   app.get("/api/pi-web/status", async () => getPiWebStatus());
   app.get("/api/pi-web/version", async () => getPiWebVersionStatus());
+  app.get("/api/plugins", async () => piWebPlugins.plugins());
+  registerConfigRoutes(app, deps.config);
 
   registerMachineRoutes(app, machines);
 

src/server/configRoutes.test.ts

@@ -0,0 +1,69 @@
+import Fastify, { type FastifyInstance } from "fastify";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { registerConfigRoutes, type PiWebConfigService } from "./configRoutes.js";
+import type { PiWebConfigResponse, PiWebConfigValues } from "../shared/apiTypes.js";
+
+let app: FastifyInstance;
+let savedConfig: PiWebConfigValues;
+let service: PiWebConfigService;
+
+beforeEach(async () => {
+  savedConfig = { host: "127.0.0.1", port: 8504, allowedHosts: [] };
+  service = {
+    read: vi.fn(() => responseFor(savedConfig, true)),
+    write: vi.fn((config: PiWebConfigValues) => {
+      savedConfig = config;
+      return responseFor(savedConfig, true);
+    }),
+  };
+  app = Fastify({ logger: false });
+  registerConfigRoutes(app, service);
+  await app.ready();
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+describe("config routes", () => {
+  it("returns the PI WEB config contract", async () => {
+    const response = await app.inject({ method: "GET", url: "/api/config" });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json<PiWebConfigResponse>()).toEqual(responseFor(savedConfig, true));
+  });
+
+  it("updates config through the service", async () => {
+    const response = await app.inject({
+      method: "PUT",
+      url: "/api/config",
+      payload: { config: { host: "0.0.0.0", port: 9000, allowedHosts: true, shortcuts: { "core:view.chat": "mod+1", "core:session.stop": null }, plugins: { info: { enabled: false, settings: { note: "hidden" } } } } },
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(savedConfig).toEqual({ host: "0.0.0.0", port: 9000, allowedHosts: true, shortcuts: { "core:view.chat": "mod+1", "core:session.stop": null }, plugins: { info: { enabled: false, settings: { note: "hidden" } } } });
+    expect(response.json<PiWebConfigResponse>().config).toEqual(savedConfig);
+  });
+
+  it("rejects invalid config payloads before writing", async () => {
+    const response = await app.inject({
+      method: "PUT",
+      url: "/api/config",
+      payload: { config: { host: 42 } },
+    });
+
+    expect(response.statusCode).toBe(400);
+    expect(response.json()).toHaveProperty("error");
+    expect(service.write).not.toHaveBeenCalled();
+  });
+});
+
+function responseFor(config: PiWebConfigValues, exists: boolean): PiWebConfigResponse {
+  return {
+    path: "/tmp/pi-web/config.json",
+    exists,
+    config,
+    effectiveConfig: config,
+    envOverrides: { host: false, port: false, allowedHosts: false },
+  };
+}

src/server/configRoutes.ts

@@ -0,0 +1,126 @@
+import type { FastifyInstance } from "fastify";
+import { effectivePiWebConfig, loadPiWebConfig, savePiWebConfig, type LoadOptions, type PiWebConfig } from "../config.js";
+import type { PiWebConfigEnvOverrides, PiWebConfigResponse, PiWebConfigValues } from "../shared/apiTypes.js";
+import { isPiWebPluginId } from "../shared/pluginIds.js";
+
+export interface PiWebConfigService {
+  read: () => PiWebConfigResponse | Promise<PiWebConfigResponse>;
+  write: (config: PiWebConfigValues) => PiWebConfigResponse | Promise<PiWebConfigResponse>;
+}
+
+export function createFilePiWebConfigService(options: LoadOptions = {}): PiWebConfigService {
+  return {
+    read: () => currentPiWebConfigResponse(options),
+    write: (config) => {
+      savePiWebConfig(config, options);
+      return currentPiWebConfigResponse(options);
+    },
+  };
+}
+
+export function currentPiWebConfigResponse(options: LoadOptions = {}): PiWebConfigResponse {
+  const loaded = loadPiWebConfig(options);
+  const effective = effectivePiWebConfig(options);
+  const env = options.env ?? process.env;
+  return {
+    path: loaded.path,
+    exists: loaded.exists,
+    config: loaded.config,
+    effectiveConfig: effective.config,
+    envOverrides: piWebConfigEnvOverrides(env),
+  };
+}
+
+export function registerConfigRoutes(app: FastifyInstance, service: PiWebConfigService = createFilePiWebConfigService()): void {
+  app.get("/api/config", async (_request, reply) => {
+    try {
+      return await service.read();
+    } catch (error) {
+      return reply.code(500).send({ error: errorMessage(error) });
+    }
+  });
+
+  app.put<{ Body: { config?: unknown } | undefined }>("/api/config", async (request, reply) => {
+    try {
+      return await service.write(parseConfigRequest(request.body?.config));
+    } catch (error) {
+      const status = isConfigValidationError(error) ? 400 : 500;
+      return reply.code(status).send({ error: errorMessage(error) });
+    }
+  });
+}
+
+function parseConfigRequest(value: unknown): PiWebConfig {
+  if (!isRecord(value)) throw new Error("PI WEB config update must include a config object");
+  const config: PiWebConfig = {};
+  const host = value["host"];
+  const port = value["port"];
+  const allowedHosts = value["allowedHosts"];
+  const shortcuts = value["shortcuts"];
+  const plugins = value["plugins"];
+  if (host !== undefined) {
+    if (typeof host !== "string") throw new Error("PI WEB config host must be a string");
+    config.host = host;
+  }
+  if (port !== undefined) {
+    if (typeof port !== "number") throw new Error("PI WEB config port must be a number");
+    config.port = port;
+  }
+  if (allowedHosts !== undefined) config.allowedHosts = parseAllowedHostsRequest(allowedHosts);
+  if (shortcuts !== undefined) config.shortcuts = parseShortcutsRequest(shortcuts);
+  if (plugins !== undefined) config.plugins = parsePluginsRequest(plugins);
+  return config;
+}
+
+function parseAllowedHostsRequest(value: unknown): string[] | true {
+  if (value === true) return true;
+  if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) {
+    throw new Error("PI WEB config allowedHosts must be true or an array of strings");
+  }
+  return value;
+}
+
+function parseShortcutsRequest(value: unknown): Record<string, string | null> {
+  if (!isRecord(value)) throw new Error("PI WEB config shortcuts must be an object");
+  return Object.fromEntries(Object.entries(value).map(([actionId, shortcut]) => {
+    if (shortcut !== null && (typeof shortcut !== "string" || shortcut === "")) throw new Error("PI WEB config shortcut values must be non-empty strings or null");
+    return [actionId, shortcut];
+  }));
+}
+
+function parsePluginsRequest(value: unknown): NonNullable<PiWebConfig["plugins"]> {
+  if (!isRecord(value) || Array.isArray(value)) throw new Error("PI WEB config plugins must be an object");
+  return Object.fromEntries(Object.entries(value).map(([pluginId, config]) => {
+    if (!isPiWebPluginId(pluginId)) throw new Error("PI WEB config plugin ids are invalid");
+    if (!isRecord(config) || Array.isArray(config)) throw new Error("PI WEB config plugin entries must be objects");
+    const enabled = config["enabled"];
+    if (enabled !== undefined && typeof enabled !== "boolean") throw new Error("PI WEB config plugin enabled values must be booleans");
+    const settings = config["settings"];
+    if (settings !== undefined && (!isRecord(settings) || Array.isArray(settings))) throw new Error("PI WEB config plugin settings must be objects");
+    return [pluginId, config];
+  }));
+}
+
+function piWebConfigEnvOverrides(env: NodeJS.ProcessEnv): PiWebConfigEnvOverrides {
+  return {
+    host: isEnvSet(env["PI_WEB_HOST"]),
+    port: isEnvSet(env["PI_WEB_PORT"]) || isEnvSet(env["PORT"]),
+    allowedHosts: isEnvSet(env["PI_WEB_ALLOWED_HOSTS"]),
+  };
+}
+
+function isEnvSet(value: string | undefined): boolean {
+  return value !== undefined && value !== "";
+}
+
+function isConfigValidationError(error: unknown): boolean {
+  return error instanceof Error && error.message.startsWith("PI WEB config");
+}
+
+function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}

src/server/piWebPluginService.test.ts

@@ -88,6 +88,31 @@ describe("PiWebPluginService", () => {
     await expect(service.readAsset("dev", "pi-web-plugin.js")).resolves.toBeDefined();
   });
 
+  it("filters disabled plugins from the manifest while reporting them through plugin status", async () => {
+    await writePlugin(join(tempDir, "plugins", "enabled"), {
+      packageJson: { piWeb: { plugins: [{ id: "enabled", module: "pi-web-plugin.js" }] } },
+      files: { "pi-web-plugin.js": "export default {};" },
+    });
+    await writePlugin(join(tempDir, "plugins", "disabled"), {
+      packageJson: { piWeb: { plugins: [{ id: "disabled", module: "pi-web-plugin.js" }] } },
+      files: { "pi-web-plugin.js": "export default {};" },
+    });
+
+    const service = new PiWebPluginService({
+      roots: [{ path: join(tempDir, "plugins"), source: "test", scope: "local" }],
+      packageProvider: false,
+      configProvider: () => ({ plugins: { disabled: { enabled: false, settings: { hidden: true } } } }),
+    });
+
+    await expect(service.manifest()).resolves.toMatchObject({ plugins: [{ id: "enabled" }] });
+    await expect(service.plugins()).resolves.toMatchObject({
+      plugins: [
+        { id: "disabled", enabled: false },
+        { id: "enabled", enabled: true },
+      ],
+    });
+  });
+
   it("skips duplicate plugin ids", async () => {
     await writePlugin(join(tempDir, "plugins", "one"), {
       packageJson: { piWeb: { plugins: [{ id: "duplicate", module: "pi-web-plugin.js" }] } },

src/server/piWebPluginService.ts

@@ -3,15 +3,22 @@ import { readdir, readFile, realpath, stat } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { DefaultPackageManager, getAgentDir, SettingsManager } from "@earendil-works/pi-coding-agent";
-import { piWebDataDir } from "../config.js";
+import { loadPiWebConfig, piWebDataDir, type PiWebConfig } from "../config.js";
+import type { PiWebPluginInfo, PiWebPluginsResponse, PiWebPluginScope } from "../shared/apiTypes.js";
+import { isPiWebPluginId } from "../shared/pluginIds.js";
 
-const pluginIdPattern = /^[a-z][a-z0-9.-]*$/u;
+export type { PiWebPluginInfo, PiWebPluginsResponse, PiWebPluginScope } from "../shared/apiTypes.js";
 
 export interface PiWebPluginManifest {
-  plugins: { id: string; module: string; source: string; scope: PiWebPluginScope }[];
+  plugins: PiWebPluginManifestEntry[];
 }
 
-export type PiWebPluginScope = "bundled" | "local" | "user" | "project";
+export interface PiWebPluginManifestEntry {
+  id: string;
+  module: string;
+  source: string;
+  scope: PiWebPluginScope;
+}
 
 export interface ConfiguredPiPackage {
   source: string;
@@ -38,6 +45,7 @@ interface PiWebPluginServiceOptions {
   cwd?: string;
   agentDir?: string;
   packageProvider?: PiPackageProvider | false;
+  configProvider?: () => PiWebConfig;
 }
 
 interface LocalPluginRoot {
@@ -80,28 +88,31 @@ export class DefaultPiPackageProvider implements PiPackageProvider {
 export class PiWebPluginService {
   private readonly roots: LocalPluginRoot[];
   private readonly packageProvider: PiPackageProvider | undefined;
+  private readonly configProvider: () => PiWebConfig;
 
   constructor(options: PiWebPluginServiceOptions = {}) {
     const cwd = options.cwd ?? process.cwd();
     const agentDir = options.agentDir ?? getAgentDir();
     this.roots = options.roots ?? defaultPluginRoots(cwd);
     this.packageProvider = options.packageProvider === false ? undefined : options.packageProvider ?? new DefaultPiPackageProvider(cwd, agentDir);
+    this.configProvider = options.configProvider ?? (() => loadPiWebConfig({ cwd }).config);
   }
 
   async manifest(): Promise<PiWebPluginManifest> {
-    const plugins = await this.discoverPlugins();
     return {
-      plugins: plugins.map((plugin) => ({
-        id: plugin.id,
-        module: `/pi-web-plugins/${encodeURIComponent(plugin.id)}/${plugin.entryFile}?v=${encodeURIComponent(plugin.version)}`,
-        source: plugin.source,
-        scope: plugin.scope,
-      })),
+      plugins: (await this.plugins()).plugins
+        .filter((plugin) => plugin.enabled)
+        .map((plugin) => ({ id: plugin.id, module: plugin.module, source: plugin.source, scope: plugin.scope })),
     };
   }
 
+  async plugins(): Promise<PiWebPluginsResponse> {
+    const [plugins, config] = await Promise.all([this.discoverPlugins(), Promise.resolve(this.configProvider())]);
+    return { plugins: plugins.map((plugin) => this.pluginInfo(plugin, config)) };
+  }
+
   async readAsset(pluginId: string, assetPath: string): Promise<{ content: Buffer; contentType: string } | undefined> {
-    if (!pluginIdPattern.test(pluginId)) return undefined;
+    if (!isPiWebPluginId(pluginId)) return undefined;
     const plugin = (await this.discoverPlugins()).find((candidate) => candidate.id === pluginId);
     if (plugin === undefined) return undefined;
 
@@ -118,6 +129,16 @@ export class PiWebPluginService {
     return { content: await readFile(realAsset), contentType: contentTypeFor(realAsset) };
   }
 
+  private pluginInfo(plugin: PluginRecord, config: PiWebConfig): PiWebPluginInfo {
+    return {
+      id: plugin.id,
+      module: `/pi-web-plugins/${encodeURIComponent(plugin.id)}/${plugin.entryFile}?v=${encodeURIComponent(plugin.version)}`,
+      source: plugin.source,
+      scope: plugin.scope,
+      enabled: config.plugins?.[plugin.id]?.enabled !== false,
+    };
+  }
+
   private async discoverPlugins(): Promise<PluginRecord[]> {
     const records = new Map<string, PluginRecord>();
     for (const plugin of await this.discoverLocalPlugins()) addUnique(records, plugin);
@@ -173,7 +194,7 @@ async function discoverLocalRoot(root: LocalPluginRoot): Promise<PluginRecord[]>
   const entries = await readdir(root.path, { withFileTypes: true }).catch(() => []);
   const plugins: PluginRecord[] = [];
   for (const entry of entries) {
-    if (!pluginIdPattern.test(entry.name)) continue;
+    if (!isPiWebPluginId(entry.name)) continue;
     const pluginRoot = join(root.path, entry.name);
     const pluginStat = entry.isDirectory() ? undefined : entry.isSymbolicLink() ? await stat(pluginRoot).catch(() => undefined) : undefined;
     if (!entry.isDirectory() && pluginStat?.isDirectory() !== true) continue;
@@ -236,7 +257,7 @@ function parsePluginEntries(piWeb: Record<string, unknown>, packagePath: string)
     if (!isRecord(entry)) throw new Error(`PI WEB plugin entry ${String(index + 1)} must be an object in ${packagePath}`);
     const id = entry["id"];
     const module = entry["module"];
-    if (typeof id !== "string" || !pluginIdPattern.test(id)) throw new Error(`Invalid PI WEB plugin id in ${packagePath}: ${String(id)}`);
+    if (typeof id !== "string" || !isPiWebPluginId(id)) throw new Error(`Invalid PI WEB plugin id in ${packagePath}: ${String(id)}`);
     if (typeof module !== "string" || module === "") throw new Error(`Invalid PI WEB plugin module for ${id} in ${packagePath}`);
     return { id, module };
   });